What is a SIEM?¶

A SIEM is a security information and event management platform.

It collects and organises events from multiple systems so they can be searched, correlated, monitored and used to generate alerts.

Avoid the dangerous assumption¶

The dangerous assumption is that a SIEM is the original source of every event it displays.

Usually, it is not.

A SIEM may receive logs from devices, servers, applications, cloud services, identity systems and security products. It parses those records, maps fields, adds context and stores them in a common platform.

That makes it useful for investigation. An analyst can search across many systems, compare accounts and devices, identify patterns and build timelines.

But the SIEM’s view depends on what was collected. A source may not have been connected, a collector may have failed, a parser may have misread fields or retention may have expired.

The SIEM may also normalise and enrich records. It can rename fields, add severity, attach user or asset information and convert timestamps. Those additions may improve usability but are not necessarily part of the original event.

Investigators should identify the source system behind each significant event. Ask whether the displayed record is raw, parsed, enriched, correlated or summarised.

Preserve the SIEM export, query, filters and time-zone settings, but obtain the original source record where interpretation or evidential precision matters.

A SIEM can help locate and connect evidence. It should not be treated as infallible or complete simply because it provides one central dashboard.

Operational takeaway¶

A SIEM is a central platform for collecting and analysing security events, but its records remain dependent on source coverage, collection, parsing, enrichment and retention.