What is security information and event management (SIEM)?
Security information and event management (SIEM) is a platform that collects logs and events from across an organization’s systems, correlates them, and raises alerts for the security operations center to investigate.
How it works
A SIEM ingests data from firewalls, endpoints, identity providers, cloud services and applications. Detection rules and analytics find patterns that indicate an attack, and the SIEM keeps the records investigations and audits need.
Adding context, such as which users are high-risk, helps analysts prioritize the alerts that matter.
Why it matters
The SIEM is the SOC’s central view. Its value depends on the data it receives and the context analysts have when an alert fires.
How Living Security helps
Living Security sends human risk into the SIEM, SOAR, DLP and identity provider, so analysts see who is driving risk when an alert fires.
