Summary
A SIEM (Security Information and Event Management) platform ingests security events from across an environment, normalises and correlates them, and produces alerts and dashboards that highlight attacks, policy violations, and operational anomalies.
What is a SIEM?
SIEM platforms sit at the centre of a security operations centre (SOC). They collect logs and events from servers, endpoints, firewalls, identity providers, mesh VPNs, cloud accounts, and applications. Inside the SIEM, events are normalised into a common schema, enriched with threat intelligence and asset context, and evaluated against detection rules.
Two evolutions have reshaped the market: SOAR (Security Orchestration, Automation, and Response) plugs response playbooks into the SIEM, and XDR (Extended Detection and Response) bundles SIEM-style correlation with endpoint telemetry. Modern infrastructure tools cooperate with the SIEM via event streaming endpoints — NetBird, for example, exposes login, policy, and connectivity events that can be forwarded directly into the customer's SIEM.
Operationally a SIEM is judged less on its product features and more on the quality of its detection content and the discipline of the team running it. Good SIEM practice requires careful log selection, tuned detection rules, regular threat hunting, and clear incident-response workflows that connect alerts to actions.
Why is SIEM relevant?
- Detection: Surfaces attacks that no single sensor would catch on its own
- Compliance: Required or expected by NIS2, DORA, ISO 27001, and PCI-DSS
- Forensics: Centralised, normalised logs accelerate post-incident investigations
- SOC enabler: Foundation that SOAR playbooks and threat-hunting workflows build on
Related Terms
- ISO 27001: Standard that expects monitoring and detection capabilities like a SIEM
- NIS2 Directive: Regulation that mandates incident detection and reporting
- Access Control List: ACL events are common SIEM inputs for detection
- Zero Trust: Generates rich, identity-aware events that SIEMs are well placed to correlate
- Device Posture: Posture changes are valuable signals for SIEM detections