SIEM

Something is constantly happening in every computer network: a user logs in, a server sends a file, a firewall — that is, a system that blocks unwanted traffic — rejects a connection. Each of these events is stored as a log, meaning an entry in a log file. In a mid-sized company, there can be millions of such entries per day. A SIEM, short for Security Information and Event Management, collects all these logs in a single place and automatically searches them for patterns that indicate an attack. It is thus something like a central control room for a company’s IT security. Instead of each department checking its own logs separately, the security team gets a unified overall picture.

SIEM as an early warning system

A single failed login is harmless. Ten thousand failed logins in one minute on the same account are an attack — a so-called brute-force attack, in which a program systematically tries out passwords. Without a SIEM, this attack would be scattered across the logs of various servers and might not be noticed at all. With a SIEM, it is recognized as a pattern and immediately triggers an alarm.

Then there is the legal dimension. In the EU, the GDPR requires companies to be able to prove and document data breaches. Many industries — banks, hospitals, energy providers — are subject to even stricter requirements. A SIEM provides the seamless records needed for this. It is therefore not just a technical tool, but often also a legal necessity.

How a SIEM turns logs into alerts

A SIEM operates in three steps. First, it collects data: logs from firewalls, servers, applications, antivirus programs, and network devices all come together at a central point. Second, it normalizes this data — meaning it translates it into a uniform format, because every device writes its logs differently. A Cisco router and a Windows server log the same process in completely different languages.

The third step is where the actual analysis takes place. The SIEM compares incoming events against predefined rules and statistical baselines. One rule might state: “Alert if a user accesses resources in three different countries within five minutes.” Modern systems supplement these fixed rules with machine learning — a method in which a program independently learns from data what is normal in a network and flags deviating behavior on its own, even without an explicit rule.

A common misconception is confusing a SIEM with a firewall. A firewall actively prevents certain traffic from entering the network — it acts in real time. A SIEM, on the other hand, observes and analyzes what is already happening in the network and raises an alarm so that people can intervene. It is a detective, not a doorbell.

SIEM in companies and in media coverage

Large companies operate SIEM systems within what is known as a SOC — a Security Operations Center, that is, a team that evaluates security alerts around the clock. Well-known products include Microsoft Sentinel, IBM QRadar, and Splunk. Microsoft Sentinel runs entirely in the cloud and became known primarily through its integration with Azure; Splunk is considered particularly flexible in handling very large volumes of data.

In news coverage, the term often comes up when an attack succeeded despite existing security technology being in place. Analysts then examine whether the SIEM could have detected the attack and why the alert was not triggered in time or not processed quickly enough. In the major SolarWinds attack of 2020, in which attackers were able to infiltrate government networks undetected for months via compromised software, this very question was, in hindsight, at the center of attention.

For smaller companies, there are simplified cloud-based variants that do not require a dedicated security team. The market for SIEM software has been growing strongly for years, because the number and complexity of cyberattacks continue to increase while regulators worldwide simultaneously demand stricter documentation requirements.