What is SIEM?
Security information and event management, or SIEM, is a holistic approach to the management of an organisation’s information technology (IT) security that seeks to look at the bigger picture. It evolved from several different, complementary technologies
‘SIEM’ itself is a catchall term for a combination of security software products and services, designed to centralise everything into a single location as well as providing a real-time analysis of security alerts. This makes it easier to pick up on any trends and patterns that are out of the ordinary, and thus pay point to a potential problem or threat.
How does it Work?
The job of any security management system is to monitor log files. These are files that record events that occur in an operating system, software runs, or messages between different users of communication software.
In older event management systems, it was only really possible to see the events that were detected as potential threats, and not what came before or after, thus no context is provided.
With SIEM, real-time monitoring and analysis means we can see the lead up to a detection and have a better chance of separating false positives from an actual attack. It also allows for the security experts to continually improve the system to meet the threats and prevent further attacks from being successful.
By linking all the components of a security system together, SIEM can tell you what is happening to your organisation in terms of securing the continuity of your business process. In other words, it encourages previously segregated security tools to communicate with one another, and to pool together all their data into a single location for a comprehensive view.
In essence, an SIEM is a giant database of logs. It correlates them all into a readable format – a process known as ‘normalising’. This allows us to search across logs from multiple devices and correlate events between them.
SIEM is a management layer to a security system that provides a single interface where all the information can be accessed and analysed far more effectively. It also gives analysts access to this information without giving them access to the systems themselves, thus further galvanising the security of your organisation’s data.
The greatest asset of SIEM is its integrated approach to recording and analysing events. Even small businesses can benefit from employing SIEM, which can be developed as the business grows.
However SIEM is not always enough. To get a truly holistic view of your security, you need data that is relevant as well as integrated threat intelligence and a unified approach.
