SIEM (Security information and event management)

A SIEM is a system that collects and analyzes security logs from many sources, such as servers, firewalls and cloud services, to detect threats and support investigations.

Every device and application produces logs of events like sign-ins, configuration changes and blocked connections. A SIEM gathers these logs in one place, correlates them and raises alerts when patterns suggest an attack, such as a sign-in from another country followed by a mass file download. It also keeps records that are essential for investigating an incident afterwards.

A SIEM is powerful but needs ongoing tuning and people to review its alerts. On its own, it can overwhelm a small business with noise. That is why most smaller organizations access SIEM capabilities through a managed security provider or security operations centre rather than running one themselves.

Practical tip: whatever tool you use, make sure logs from key systems such as Microsoft 365, firewalls and servers are retained long enough to investigate an incident. If a breach is discovered months later, missing logs can make it impossible to tell what information was accessed, which complicates PIPA reporting decisions.