SIEM (Security Information and Event Management)

SIEM (Security Information and Event Management) is a platform that gathers log and event data from servers, network devices, applications and cloud services, normalizes it and applies correlation rules to surface likely security incidents. It also stores the data for search, reporting and investigation.

Why it matters

A single failed login means little, but the same account failing on ten servers, followed by a success from a new country, tells a story. No individual system sees that pattern; a SIEM can, because it holds all the logs together. Retained logs also support audits and post-incident forensics.

Example

A correlation rule might read: if one source IP produces more than 20 failed logins across different accounts within five minutes, followed by a successful login, raise a high-priority alert. The analyst then opens the related events from the VPN, directory service and application logs in one timeline.

Common mistakes

• Ingesting everything without a plan. Cost and noise grow, while the important sources may still be missing.
• Not tuning rules, which causes alert fatigue.
• Forgetting log time synchronization. Events with unsynchronized clocks cannot be correlated reliably.
• Treating a SIEM as set-and-forget software rather than a process that needs owners.

Related

• SOC (Security Operations Center)
• IDS and IPS
• Disaster recovery
• Data breach

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.