Määritelmä
A SIEM collects the logs produced by firewalls, servers, directory services, antivirus and applications in one place, correlates them and turns suspicious patterns into alarms. Events that look innocent alone (failed logins at midnight, then a successful one, then a large file copy) form the picture of an attack when combined; the SIEM does that combining. Tamper-proof storage of logs is also needed for post-incident investigation and regulatory audits. It is standard in large organisations; small and mid-size businesses use it as a managed service or as a simplified central log server. Without someone to read the alarms a SIEM is just an expensive archive.
Miten SMB Teknoloji käyttää sitä
For small and mid-size businesses we set up a central log server with basic correlation rules, combined with ISO 27001 and 5651 logging requirements; in larger environments we integrate a SIEM.