SIEM — Security Information and Event Management

Concept

Security Information and Event Management (SIEM) is a security capability that collects data from many sources into one place, analyzes it, and alerts the security team to potential threats.

The name combines two older disciplines:

Part	Focus
Security Information Management (SIM)	Long-term collection, storage, search, and reporting
Security Event Management (SEM)	Real-time monitoring, correlation, and alerting

Without a SIEM, security teams must check each system's logs separately. A SIEM provides a single view across the environment and connects events that would otherwise look unrelated.

SIEM and xSIEM

This page describes SIEM as a capability. SentriaOne xSIEM (eXtended Security Intelligence & Event Management) is the platform that combines SIEM with NDR, NPM, and Incident Response. See Platform Overview.

How a SIEM works

1. Collect logs from end devices, network devices, cloud services, and applications. See Log Sources.
2. Normalize and enrich the data so it can be analyzed consistently. See Data Processing.
3. Store and index the data for fast search and for retention.
4. Correlate and detect threats using rules, analytics, and machine learning.
5. Alert the security team when a potential threat is found.
6. Investigate using search, dashboards, and the related events.

SIEM in SentriaOne xSIEM

SIEM is one of the capabilities of the SentriaOne xSIEM (eXtended Security Intelligence & Event Management) platform. It integrates and correlates data from multiple sources with real-time analytics, anomaly detection, signatures, and machine learning.

Capability	Description
Real-time analytics	Data is analyzed as it arrives
Anomaly detection	Activity that deviates from normal behaviour is identified
Signature and ML detection	Known patterns and machine learning models are both used
MITRE ATT&CK correlation	Detections are correlated using the MITRE ATT&CK framework

SIEM works together with Log Management, which provides:

• Smart search and an integrated dashboard
• Flexible data retention options
• Customizable data export options

Relationship to other xSIEM capabilities

SentriaOne xSIEM extends SIEM with the following capabilities in the same platform.

Capability	Relationship to SIEM
NDR	Adds detections from raw network traffic to the log-based view
NPM	Adds network and application performance context
Incident Response	Turns detections into tracked cases and response actions