🎁 New User? Get 20% off your first purchase with code NEWUSER20 Register Now →
Menu

Categories

Security Advanced

What is SIEM (Security Information and Event Management)?

A platform that collects, correlates, and analyzes security events from across an organization to detect threats and incidents.

SIEM systems aggregate logs from firewalls, servers, applications, and endpoints, then apply correlation rules to identify suspicious patterns. A single failed login is normal; 1000 failed logins across 50 servers in 5 minutes triggers an alert.

Features include real-time monitoring, threat detection, compliance reporting, forensic investigation, and incident response workflows. Popular solutions include Splunk, IBM QRadar, Microsoft Sentinel, and Elastic Security. SIEM is central to Security Operations Centers (SOCs).

Related Terms

Data Loss Prevention (DLP)
A strategy and set of tools that detect and prevent unauthorized transmission of sensitive data outside an organization.
RBAC (Role-Based Access Control)
An access control model where permissions are assigned to roles, and users are assigned to roles rather than getting permissions directly.
Penetration Testing
An authorized simulated cyberattack on a system to evaluate its security defenses and identify vulnerabilities.
Session Hijacking
An attack where an adversary takes over a legitimate user session by stealing or predicting the session identifier.
Security Headers
HTTP response headers that instruct browsers to enable security features like XSS protection, framing prevention, and content type enforcement.
CORS (Cross-Origin Resource Sharing)
A browser security mechanism that controls which web domains can access resources from another domain via HTTP requests.
 View All Security Terms →