Security - Technology
SIEM
(Security Information and Event Management)
A security platform that collects system activity and looks for signs of suspicious behaviour
What's it for?
Brings security activity from many systems together so suspicious patterns are easier to spot and investigate.
For example…
The SIEM links a VPN login from a new country with a mass mailbox forward rule and raises a high-priority case.
A SIEM collects login, firewall and endpoint logs and raises one correlated alert when the same account behaves suspiciously across several systems
Think of it like…
Central switchboard for building alarms — many sensors, one place to make sense of them