SIEM.

Security Information and Event Management (SIEM) is the central log analytics platform of a SOC. It ingests logs and telemetry from firewalls, endpoints, identity providers, cloud APIs, applications and network sensors, then normalizes and stores them so that correlation rules, statistical baselines and machine-learning models can produce prioritized alerts. Modern SIEMs (Splunk, Microsoft Sentinel, Elastic, Chronicle, QRadar) also support detection-as-code, UEBA, threat-intelligence enrichment and integration with SOAR for automated response. The SIEM is the system of record for incident investigations, compliance reporting and long-term forensic retention.

How a SIEM processes an event

flowchart LR
  A[Sources: firewalls, EDR, IdP, cloud, apps] --> B[Collector / forwarder]
  B --> C[Parse and normalize to schema]
  C --> D[Enrich: threat intel, asset, geo, identity]
  D --> E[Index and store]
  E --> F{Correlation rules and UEBA baselines}
  F -->|match| G[Prioritized alert]
  F -->|no match| H[Retained for hunting and compliance]
  G --> I[SOAR playbook / analyst triage]

Why tuning matters more than collection

A SIEM only helps if someone acts on what it surfaces. In the 2013 Target breach, the retailer's FireEye and monitoring stack did generate malware alerts on 30 November and 2 December, and staff in its Bangalore watch centre escalated them to Minneapolis — yet no one investigated, and the automatic-quarantine feature had been switched off. The intrusion was ultimately discovered by an outside payment processor, not Target's own tooling. The lesson is that raw collection is cheap while signal is hard: alert fatigue, unowned use cases and untuned rules turn a SIEM into an expensive log archive. Effective programs treat detections as versioned code aligned to MITRE ATT&CK, measure mean-time-to-detect, prune noisy rules, and normalize telemetry against open schemas such as OCSF so content is portable across vendors. Retention must also satisfy regulatory mandates (PCI DSS, HIPAA, SOX) that dictate how long security logs are kept and how their integrity is protected.