Security Information and Event Management (SIEM)

Security Information and Event Management (SIEM) is a conceptual framework for collecting, correlating, and analyzing security logs and events. It enables detection, investigation, and response to security incidents as well as compliance reporting. SIEM systems aggregate telemetry from diverse sources and provide centralized monitoring and forensic analysis.

Use this profile to understand the building block briefly, place it in the model, and switch to the 360° assessment when needed.

Content type

Concept

Theoretical construct: explains a term, principle, or mental model.

Classification level

Structure

What organizes, connects, or makes decisions possible.

Available perspectives

Open this building block directly in an already curated view.

360°

In brief

Security Information and Event Management (SIEM) in brief

A SIEM collects, correlates, and analyzes security-relevant events from many sources.

Where does it come from?

SIEM grew by combining security information management and security event management to analyze log data centrally for monitoring and response. NIST SP 800-92 covers foundations of security log management.

The mental model

Logs and events are collected, normalized, retained, and correlated centrally. Rules and analytics produce investigation leads; usefulness depends on source quality, timing, context, and response processes. SIEM is a monitoring and analysis component, not complete protection.

Key building blocks

Core idea

Distributed security events are brought together for detection and investigation.

Mechanism

Normalization, correlation, and rules turn raw events into analytical leads.

Practice context

Results depend on log coverage, integrity, retention, and operational response.

When is it useful?

SIEM helps organize security monitoring and investigations across many systems while exposing the limits of available evidence.

NIST SP 800-92 Guide to Computer Security Log Management

Why is this building block relevant?

A conceptual framework for centralized collection, correlation and analysis of security logs and events to detect and respond to incidents.

Position in the model

Where this building block is located in the topic model.

No structure path available.

Knowledge network

Explore how this building block connects to concepts, methods, technologies, and tools.

External references

These sources establish the term and its professional meaning.

Security information and event management – Wikipedia NIST Special Publication 800-92: Guide to Computer Security Log Management Elastic Security documentation (Getting started / Guides)

Connections as a list

All direct connections of the current building block in a compact text view.

Process · Enables

(1)

Threat Hunting

Method

Additional classification

This classification shows where the building block typically matters, how demanding it is, and what kind of impact it has in the model.

Organizational level

Enterprise

The level within the organization (enterprise, domain, team) at which the AssetBlock is applied.