A real intrusion rarely announces itself in one place. A failed login on a workstation, a new service account in the directory, an outbound connection from a database host, each is unremarkable on its own log, sitting on its own machine. The attack is the relationship between them, and that relationship is only visible if the logs live somewhere they can be compared. This is the premise of security information and event management: the detection problem is often not sensitivity on any one source but the fact that the sources are scattered.
The idea
A SIEM combines security information management with security event management to pool logs from many disparate systems and correlate them into a single analyzable stream. The load-bearing move is centralization plus correlation: individually benign events across different hosts are linked into one meaningful sequence that reveals an attack no single log could show. Without that pooled, correlated view, most security controls are blind to the multi-step, multi-host activity they nominally exist to catch.
SIM plus SEM
The acronym is a merger of two older capabilities. “SIEM combines security information management (SIM) and security event management (SEM) to enable real-time analysis of security alerts generated by applications and network hardware.” SIM is the storage-and-analysis half, the long-term retention and reporting over historical log data. SEM is the real-time half, the live monitoring and alerting on events as they arrive. A SIEM is the combination: it both keeps the history and watches the present, over the same aggregated data.
Correlation is the mechanism
Aggregation alone is a bigger haystack. The step that produces detections is correlation, and Wikipedia describes it directly: “correlation looks for common attributes and links events together into meaningful bundles.” A single failed login is noise. Failed logins across twenty hosts from one source in one minute, followed by a success, is a password-spray that landed, and it is a detection only because the events were joined on a shared attribute (the source) across sources that individually saw one attempt each. Correlation is what converts a stream of isolated records into the sequence a rule or an analyst can recognize.
Why the logging discipline comes first
The uncomfortable implication is that a SIEM is only as good as the telemetry fed into it, which makes disciplined logging a prerequisite rather than an accessory. A control that blocks an action but does not log it is invisible to correlation. A host whose logs never reach the SIEM is a gap the correlated view cannot cover. The centralization is therefore an architectural commitment: consistent log generation at every source, reliable transport to the collector, and enough retention that a slow campaign spanning weeks can still be reconstructed after the fact. The detection capability is downstream of that plumbing.
Detection lives at the join, not the sensor
The instinct to improve detection by tuning one sensor misreads where the signal is. In a multi-host intrusion, no single sensor holds enough to decide, which is exactly why the events must be pooled before they can be correlated. Investing in coverage and correlation across sources usually buys more than sharpening any one alarm, because the attack’s signature is distributed by construction.
Related Notes
- IDS and IPS, the sensors whose alerts are among a SIEM’s most important inputs
- The Incident Response Lifecycle, whose detection and analysis phase runs on this correlated telemetry
- The Cyber Kill Chain and MITRE ATT&CK, the frameworks that name the multi-step activity correlation is trying to reconstruct
Sources
- “Security information and event management,” Wikipedia. https://en.wikipedia.org/wiki/Security_information_and_event_management . Supports that “SIEM combines security information management (SIM) and security event management (SEM) to enable real-time analysis of security alerts generated by applications and network hardware,” and that “correlation looks for common attributes and links events together into meaningful bundles.”