SIEM: what it is and how it works

In short

Every system keeps a diary of what happens: logins, errors, programs started, changes. On its own, each diary says little. A SIEM reads them all together and looks for the combinations that matter: ten wrong passwords followed by a successful login, an administrator account used at three in the morning, the same user logged in from two countries in the same minute.

How it works

• Collection: agents installed on the endpoints, or connectors to firewalls, servers and cloud services, send the events.
• Normalisation: different formats are mapped to common fields (user, machine, address, outcome, time).
• Correlation: rules and models compare events with one another and over time. Many rules are described using the techniques in the MITRE ATT&CK catalogue.
• Alert: when a rule fires, a notification goes out with its severity.
• Retention: logs stay archived for investigation after an incident and for legal obligations, such as the Italian requirement to record the logins of system administrators for at least six months.

Why it matters

An attack is rarely visible in a single event. A SIEM is the tool that puts the pieces in order, and without centralised logs an investigation after an incident stops immediately: "who got in, when, from where?" goes unanswered.

The well-known limit is noise. A newly installed SIEM produces hundreds of alerts, many of them harmless. It has to be tuned (excluding what is normal for that company) and, above all, someone has to read the alerts. That is why a SIEM almost always goes hand in hand with a SOC or an MDR service. For more detail, read the guide what is a SIEM.

Example

On a Friday evening the SIEM records twenty failed login attempts on the file server with different usernames, all from the same PC in the purchasing department. A few minutes later, a successful login with an administrator account comes from that PC. Taken one by one, these are trivial events; together they describe an attempt to guess passwords from a machine that is already compromised. The correlation rule raises a critical alert, and whoever receives it can isolate the PC before the attack goes any further.

Related terms

• XDR and EDR: detection and response on endpoints and other sources
• HIDS and File Integrity Monitoring
• Threat hunting
• Indicators of compromise (IoC)