What is SIEM?
Security Information and Event Management: the layer that turns millions of log lines into the handful of incidents your teams can actually act on.
4 min read
Contents
Noise is not the problem, sorting is
Your servers, firewalls, SaaS applications and workstations constantly write down what they do. Taken one by one, those logs mean nothing. Put end to end, they add up to millions of lines a day.
A SIEM does more than store them. It brings them back to a common format, relates them to one another, then applies correlation rules and behavioural models to isolate whatever falls outside the ordinary.
The output is therefore not a bigger volume but a smaller one: a few documented, prioritised incidents. Microsoft Sentinel goes further by natively integrating response automation.
Raw stream
- 04:12:07auth.successuser=j.tran src=203.0.113.44
- 04:12:09fw.allowdst=10.4.2.19:443 proto=tcp
- 04:12:11m365.file.readcount=18 site=HR-Payroll
- 04:12:14auth.successuser=j.tran src=198.51.100.7
- 04:12:16edr.processpowershell.exe parent=winword.exe
- 04:12:18dns.querycdn-update-svc.net type=TXT
From noise to signal, stage by stage
A SIEM is a chain. At every stage the volume drops and the value rises. That narrowing, and nothing else, is what makes day-to-day security sustainable.
- Servers
- Cloud
- Network
- Applications
- Identities
12,400,000raw events
Stage 1 · Sources
Everything that speaks
Every device, cloud service and identity emits its own logs, in its own format.
2,100,000events kept
Stage 2 · Collection
One common format
Ingestion, timestamping, deduplication, enrichment: logs finally become comparable with one another.
340alerts raised
Stage 3 · Correlation
Whatever breaks the pattern
Detection rules, known-threat lists and behavioural models relate events to one another.
7qualified incidents
Stage 4 · Delivery
What reaches you
Prioritised alerts, a reconstructed timeline and dashboards: material you can work with directly.
Three weak signals, one incident
On their own, none of these events would justify an alert. Their combination is what carries meaning, and combining them is exactly what a SIEM is for.
- Successful sign-in from Paris at 22:40
- Successful sign-in from Hanoi at 03:12
- No travel declared for that employee
What the SIEM concludes
Impossible travel
Two perfectly valid authentications, separated by a distance nobody covers in that time. The account is almost certainly compromised.
- A service account opens an HR share
- It had never accessed it in eighteen months
- 4,200 files read in six minutes
What the SIEM concludes
Likely exfiltration
Every single action is authorised. The break with the account's usual behaviour, and the read rate, are what give the bulk copy away.
- Failed sign-ins across forty accounts
- A single password tried per account
- From an address range never seen before
What the SIEM concludes
Password spraying
No account ever hits the lockout threshold. Account by account the attack is invisible; across the tenant it is obvious.
The four faculties of a SIEM
They work together and none is enough on its own: a SIEM that sees everything but prioritises nothing produces noise, not security.
What does it see?
Centralised collection
Hundreds of different sources brought into a single repository you can query from one place.
What does it understand?
Continuous correlation
Events with no apparent link, related in real time, so that an attack scenario surfaces.
What does it tell you?
Prioritised alerts
A criticality level and context on every alert, so your teams handle what matters first.
What does it prove?
Traceability and compliance
A timestamped, replayable history, required by NIS2, ISO 27001 or your insurers during an audit.
A SIEM is not a log warehouse
The difference is not about storage: it is about what happens to the data once it is there.
| Situation | Log collection | SIEM |
|---|---|---|
| What you get | Stacked lines | Qualified incidents |
| During an attack | Nothing surfaces on its own | An alert fires within minutes |
| To retrieve a fact | A manual search, if you know what to look for | A query and a reconstructed timeline |
| Facing an auditor | A raw export to reprocess | Timestamped, replayable reports |
Read next
DefinitionArticle · 5 min
What is SOAR?
Security Orchestration, Automation and Response: the automation that runs in seconds the response an analyst would take far longer to carry out by hand.
Read the articleDefinitionArticle · 3 min
What is a Modern SOC?
Discover how businesses effectively protect themselves against cyber threats through a modern Security Operations Center, combining human expertise and advanced technologies.
Read the article
Microsoft Sentinel, the SIEM we deploy
We design the correlation rules, tune the noise level and deliver actionable incidents rather than a pile of alerts.