What is a SIEM and How Does a SOC Use It?

SIEM stands for Security Information and Event Management. It is the central tool in most Security Operations Centres (SOCs), bringing logs from across an organisation into one place so threats can be detected and investigated.

What a SIEM does

• Collects logs from firewalls, servers, endpoints, cloud services and applications.
• Normalises data so events from different sources can be compared.
• Correlates events using rules to detect suspicious patterns.
• Raises alerts and provides dashboards for monitoring.
• Stores data so analysts can investigate past activity.

How a SOC analyst uses a SIEM

A typical day involves monitoring the alert queue, triaging each alert, searching related logs to build context, and escalating confirmed incidents. Analysts also help tune noisy rules so the team can focus on real threats.

Common SIEM platforms

Splunk Enterprise Security, Microsoft Sentinel, IBM QRadar and Elastic Security are widely used. The concepts — log sources, correlation, alerting and investigation — carry over between tools.