What is SIEM? Security information and event management explained
A SIEM gathers security logs in one place and looks for signs of attack. Whether you need your own depends on who will watch it.
A security information and event management system, or SIEM, collects logs and security events from across your IT estate, stores them in one place and analyzes them for signs of an attack. When it finds something suspicious, it raises an alert for an analyst to investigate.
SIEMs serve two jobs. They help detect attacks in progress, and they keep the records you need to investigate an incident and meet audit requirements.
What a SIEM collects
A SIEM is only as useful as its data. Typical sources include:
| Source | What it shows |
|---|---|
| Domain controllers and identity provider | Sign-ins, failed logins, new accounts, privilege changes |
| VPN and remote access | Who connected, from where, and when |
| Cloud platforms and SaaS audit logs | Configuration changes, data access, admin actions |
| Endpoint protection | Malware detections and suspicious behavior on devices |
| Firewalls and network devices | Blocked and allowed traffic |
| Email security | Phishing and malicious attachments |
CISA's 2025 guidance, written with Australia's ACSC, includes a separate document on which logs to ingest first. Petri's summary of it names domain controllers, VPNs and cloud services among the priorities.
SIEM, SOAR, XDR and MDR
These terms overlap, and vendors use them loosely.
| Term | What it is |
|---|---|
| SIEM | Collects and analyzes logs from many sources, raises alerts |
| SOAR | Security orchestration, automation and response: runs playbooks that act on alerts, such as disabling an account |
| XDR | Extended detection and response: a vendor's detection across its own endpoint, email, identity and cloud products |
| MDR | Managed detection and response: an outside team that watches and responds for you |
Do you need one?
A SIEM makes sense when you have many log sources, compliance requirements to keep logs, and people to tune and watch it. Without the people, it becomes an expensive archive.
For many mid-size companies, the realistic choice is between running a SIEM with a small team, buying MDR, or relying on the detection built into the platforms they already use. The deciding question is the same each time: who looks at the alerts, and how fast?
What IT teams should do
- Write down who reviews security alerts today, including nights and weekends.
- List your log sources and check how long each one keeps its logs.
- Before buying a SIEM, price the data volume and the staff time to run it.