# Why do companies use a SIEM?

To keep logs from many systems in one place, search them and correlate events across them. A SIEM (security information and event management) collects logs from firewalls, servers, directories, VPNs and cloud services, keeps them for a set period, and runs searches that look for suspicious combinations, such as a failed login on the VPN followed by a successful one from another country. Companies use it for three reasons: detection, investigation after the fact, and evidence for auditors and regulators who expect logs to be kept centrally. Its weakness is effort: someone has to choose the sources, write and tune the searches and read the results, or the SIEM becomes an expensive archive. A SIEM sees only what systems log; it does not see traffic that leaves no log. Network detection covers that part, and NetSenX can export its alerts to your SIEM from the Business plan.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/why-do-companies-use-a-siem

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [Does a small business need a SIEM at all?](https://netsenx.com/en/faq/does-a-small-business-need-a-siem)
- [Do I need a SIEM if I have NDR?](https://netsenx.com/en/faq/do-i-need-a-siem-if-i-have-ndr)
- [Can network detection feed alerts into our existing SIEM?](https://netsenx.com/en/faq/can-network-detection-feed-alerts-into-our-siem)
- [How is NetSenX different from a signature-based IDS?](https://netsenx.com/en/faq/how-is-netsenx-different-from-a-signature-based-ids)
- [What is the difference between NDR and an IDS or IPS?](https://netsenx.com/en/faq/what-is-the-difference-between-ndr-and-an-ids-or-ips)