English
Menu

What is SIEM (security information and event management)?

A system that collects logs from firewalls, servers, EDR, cloud services, authentication infrastructure and more in one place, normalizes their formats and timestamps, detects suspected attacks with rules that combine several events (correlation analysis) and presents them as alerts. It is also used to search logs during investigations and to retain logs for long periods as regulations require. It is one of the central tools that analysts in a security operations center (SOC) use for monitoring.

Japanese name: SIEM(セキュリティ情報イベント管理)

SIEM (security information and event management) appears in 2 practice questions across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

An example of correlation

Events that cannot be judged from a single log become more suspicious in combination. For example, a sequence such as "many failed logins for one account in a short time, followed immediately by a successful login from an unusual country and then a large number of file downloads" is combined into a single alert.

Log management as a prerequisite

The quality of detection and investigation depends on the quality of the logs collected. Collecting the necessary logs without gaps, synchronizing the clocks of all devices with NTP and storing the logs in a tamper-resistant way for a set period (such as the period required by regulations or contracts) are prerequisites. Since cost grows with log volume, what to collect is decided according to the purpose.

Tuning alerts

Rules that are too broad produce masses of false positives and cause analysts to miss real attacks (alert fatigue). Tuning the rules to the environment and automating routine checks with SOAR lets analysts concentrate on the important alerts.

Try it: questions about SIEM (security information and event management)

Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?

  1. ASIEM is software that records endpoint behavior, SOAR is a device that encrypts traffic, and SOC is an identifier given to vulnerabilities
  2. BSIEM automatically runs response procedures, SOAR collects and analyzes logs from each device, and SOC is the development team that handles product vulnerabilities
  3. CSIEM collects and correlates logs from many devices, SOAR automatically runs response procedures (playbooks), and SOC is the team that uses them for monitoring
Show answer and explanation

Answer: C. SIEM collects and correlates logs from many devices, SOAR automatically runs response procedures (playbooks), and SOC is the team that uses them for monitoring

SIEM (security information and event management) collects logs from firewalls, servers, EDR, cloud services and so on in one place, aligns their timestamps and presents suspected attacks as alerts using rules that combine several events (correlation analysis). SOAR (security orchestration, automation and response) automatically runs set procedures such as gathering information, isolating devices and disabling accounts as playbooks in response to alerts, reducing analysts' workload. The SOC (security operations center) is the team that uses these to monitor, analyze alerts and determine and report whether something is an incident, and it often operates around the clock. Response to the incidents identified by the SOC is usually led by the CSIRT.

At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?

  1. A2 analysts
  2. B3 analysts
  3. C10 analysts
Show answer and explanation

Answer: B. 3 analysts

The alerts that analysts review number 1440 × (1 − 0.75) = 360 a day, or 360 ÷ 24 = 15 an hour. One analyst can handle 60 ÷ 10 = 6 alerts an hour, so the number needed is 15 ÷ 6 = 2.5, which rounds up to 3. Without SOAR's automated processing there would be 60 alerts an hour, requiring 60 ÷ 6 = 10 analysts. In practice there are breaks and other duties, and the number of alerts varies by time of day, so staffing is decided with a margin in utilization.

FAQ

How do SIEM and SOAR differ?

SIEM collects and analyzes logs to find suspected attacks. SOAR automatically runs set procedures (playbooks), such as gathering information or isolating a device, in response to the alerts found. Some products provide both functions together.

Will a SIEM stop attacks automatically?

A SIEM itself is mainly for detection and investigation and does not block traffic. Stopping an attack is the role of automated responses by SOAR, devices such as EDR and firewalls, and the people who make decisions.

SIEM (security information and event management) in the explanations

Questions that mention SIEM (security information and event management) (2)

  1. Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?
  2. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

EDR (endpoint detection and response) Security operations center Cyber Kill Chain Digital forensics Incident response Indicator of compromise (IoC) Intrusion detection system (IDS) Lateral movement MITRE ATT&CK Penetration testing

Back to the glossary