# SIEM

**What is a SIEM?**

A SIEM (security information and event management) is a system that collects the logs of many individual IT systems in one place, brings them into a uniform form and searches them for patterns that point to an attack. It joins events from different sources into a single picture.

The value lies in the joining. A single event says little on its own. Failed logins happen every day because someone mistypes a password. A login at three in the morning may be the night shift. A newly created administrator account may be a planned change. If those three events occur within an hour of one another, however, and antivirus software is switched off on a machine shortly afterwards, a pattern emerges that no single message shows by itself. Making exactly that connection is what a SIEM does.

Building one takes more work than it appears from outside. First the sources have to be connected: firewall, servers, Microsoft 365 or a comparable cloud service, the encrypted remote route into the company network, remote maintenance, the protective software on the workstations and the backup runs. Each of these systems reports in a language of its own, with its own fields and its own names for the same event. Those messages must be translated into one common structure, so that the question of who signed in, when and from where has the same shape of answer across every system. The clocks of all systems must also be set to the same time, because joining events across several systems is only ever as precise as their shared time base.

Then the real work begins. A SIEM can recognise a deviation only if it knows what is normal in this particular business. Night shifts, access from holiday, service accounts working automatically around the clock, the maintenance windows of the IT provider: all of this is unremarkable and has to be recorded as unremarkable. Where that does not happen, the system reports hundreds of false alarms a day. The consequence is familiar and dangerous, because the alerts then stop being read and the one real alert is lost in the crowd. This tuning is not a one time setting. It continues in operation, because the business itself keeps changing.

Then there are the questions of retention. Logs need storage, and the cost usually follows the volume of data. It has to be decided which sources are kept and for how long. The collected logs are themselves worth protecting, because they show what the business looks like from the inside, and because an attacker would delete them first. They also contain personal data, since they record who signed in and when. Purpose, retention period and rights of inspection therefore belong in writing beforehand, and any staff representation should be involved.

A SIEM replaces no safeguard. It prevents no attack, it makes one visible. Its value only unfolds once the alerts reach someone who assesses them and acts, for example your IT provider with an agreed response time, or a SOC (security operations centre), meaning a team that evaluates incoming alerts around the clock. For businesses without their own IT department a SIEM is therefore always a question of ongoing operation rather than of a one time purchase.

## Related terms
- [Monitoring and logging](https://vetosec.at/en/it-security/monitoring-logging/)
- [IT emergency plan](https://vetosec.at/en/it-security/notfallplan/)
- [Antivirus and EDR](https://vetosec.at/en/it-security/edr-virenschutz/)
- [NIS2](https://vetosec.at/en/it-security/nis2/)

## Source
https://vetosec.at/en/it-security/siem/ (vetosec, schutz)