Gartner coined the term in 2005 by combining two older categories: security information management (SIM), which stored and reported on logs, and security event management (SEM), which analyzed events in real time. A SIEM does both. It is often the central tool of a security operations center (SOC).
How a SIEM works
- Collect. Logs and events arrive from agents, syslog, cloud APIs and integrations.
- Normalize. Different formats are mapped to common fields, such as user, source IP, action and result, so one rule can work across many sources.
- Correlate and detect. Rules and analytics look for patterns that no single event shows: many failed logins followed by a success, a login from two countries an hour apart, a new admin account created outside a change window.
- Alert and triage. Detections become signals that analysts assign, investigate, suppress or escalate.
- Investigate and report. Retained data supports investigations and compliance reports.
Typical data sources
- Operating system and audit logs from Linux and Windows
- Identity providers such as Okta, Microsoft Entra ID and Google Workspace
- Cloud audit and network logs, such as AWS CloudTrail and VPC Flow Logs
- Firewalls, VPNs and intrusion detection systems
- Endpoint security tools
- Kubernetes audit logs and application logs
Use cases
- Threat detection: brute-force attempts, privilege escalation, suspicious API calls, known attack techniques. Many SIEMs map their rules to the MITRE ATT&CK framework.
- Investigation: reconstructing what an attacker or a compromised account did. See incident response.
- Compliance: frameworks such as PCI DSS, HIPAA and SOC 2 expect security logs to be collected, reviewed and retained. PCI DSS, for example, requires audit logs to be kept for at least 12 months, with the last three months immediately available.
SIEM, SOAR and XDR
- SOAR (security orchestration, automation and response) automates the response, such as disabling an account or blocking an IP, once a SIEM detects something.
- XDR (extended detection and response) is usually built around one vendor's endpoint and security products, while a SIEM takes data from any source.
Common challenges
- Alert fatigue: untuned rules produce more signals than analysts can review.
- Cost: many SIEMs charge by data volume, which pushes teams to drop useful logs.
- Coverage gaps: a source that was never connected can't be detected or investigated.
SIEM in Atatus
Atatus SIEM runs built-in detection rules mapped to MITRE ATT&CK, plus custom rules you can build and test, against sources such as Linux audit logs and syslog, Kubernetes audit logs, file integrity monitoring, AWS CloudTrail, VPC Flow Logs and Okta. Analysts can assign, mute and suppress signals, send notifications to Slack, Microsoft Teams, email or PagerDuty, and produce compliance reports for SOC 2, PCI DSS, HIPAA, ISO 27001 and NIST CSF. For a comparison of tools, see SIEM tools and open-source SIEM tools.