Why do companies use a SIEM?

To keep logs from many systems in one place, search them and correlate events across them. A SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. (security information and event management) collects logs from firewalls, servers, directories, VPNs and cloud services, keeps them for a set period, and runs searches that look for suspicious combinations, such as a failed login on the VPN followed by a successful one from another country. Companies use it for three reasons: detection, investigation after the fact, and evidence for auditors and regulators who expect logs to be kept centrally. Its weakness is effort: someone has to choose the sources, write and tune the searches and read the results, or the SIEM becomes an expensive archive. A SIEM sees only what systems log; it does not see traffic that leaves no log. Network detection covers that part, and NetSenX can export its alerts to your SIEM from the Business plan.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics