SIEM

Security Information and Event Management (SIEM) is a security management approach that merges security information management (SIM) and security event management (SEM) into a unified system. Pronounced “sim” with a silent e, SIEM is designed to aggregate pertinent data from various sources, detect deviations from the norm, and take appropriate actions. For instance, when a potential issue arises, a SIEM system may log additional information, generate an alert, and direct other security controls to halt the activity. SIEM systems can be rule-based or use a statistical correlation engine to establish relationships between event log entries. Advanced SIEM systems may incorporate User and Entity Behavior Analytics (UEBA) and Security Orchestration, Automation, and Response (SOAR) for enhanced capabilities.