Security Information And Event Management (SIEM).

What is a SIEM?

SIEM stands for security information and event management. A SIEM is a tool that collects log records from many systems and keeps them in one place. In plain terms, a log is a record that a computer system writes about something that happened on it. The NIST glossary, quoting NIST SP 800-92, describes this kind of software as “a program that provides centralized logging capabilities for a variety of log types.”

How does a SIEM work?

The central idea is to bring logs together. Each system in an organization writes its own logs. Reading them one by one is slow. A SIEM gathers them into one place so that a team can look at them side by side. CISA calls this step log ingestion, and it publishes a guidance document called Priority Logs for SIEM Ingestion that helps practitioners decide which logs to collect and in what order.

NIST SP 800-92 is the guide that sits behind the NIST definition. NIST says it aims to help organizations understand the need for sound computer security log management. It also says the guide gives practical guidance on building log management infrastructures and processes. NIST adds that the guide presents logging technologies from a high-level viewpoint and is not a step-by-step guide to using them.

Why do organizations use a SIEM?

CISA says that executives can use these technologies to improve visibility into network activities. It says this can help an organization detect and respond to cyber threats quickly. For practitioners, CISA says the tools can help them quickly identify and respond to potential threats and streamline incident response. Incident response means the steps a team takes when something suspicious has happened.

What is a simple example?

This is a simple illustration only. Imagine that one system records a sign-in problem and another system records unusual activity. Each record alone may look small. When both records are in one place, an analyst can read them together and decide whether they need a closer look.

How do you get started with a SIEM?

CISA published its guidance together with the Australian Signals Directorate’s Australian Cyber Security Centre and other international partners. The set has three documents. One is executive guidance for leaders. One is practitioner guidance on implementing SIEM and SOAR platforms. One is practitioner guidance on priority logs for SIEM ingestion. SOAR is the technology that CISA pairs with SIEM in this guidance. Anyone planning a SIEM can read these three documents first.

Is a SIEM the same as log management?

Not exactly. Log management is the wider practice of generating, storing and handling logs, and NIST SP 800-92 covers it as a whole. A SIEM is one kind of software that supports this work by centralizing the logs. The two terms are close, but log management describes the practice and a SIEM describes a tool.

Is a SIEM the same as threat intelligence?

No. A SIEM works with logs from an organization’s own systems. Threat intelligence is information about threats gathered from outside sources. The two can be used side by side, but they are different things.

Related terms

Related terms include incident response plan, threat hunting and threat intelligence.