# What is Security Information and Event Management (SIEM)?

> Security information and event management (SIEM) is a platform for collecting, normalizing, searching, correlating, and retaining security-relevant event data from multiple systems.

- Canonical URL: https://yellowcube.eu/glossary/security-information-and-event-management/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It gives analysts a central place to investigate activity, run detection rules, build timelines, and produce operational or compliance reporting.

A SIEM is only as useful as the data and use cases behind it. Connecting a large number of log sources does not automatically produce meaningful detection: teams must select the right events, maintain parsers, tune rules, protect log integrity, control cost, and validate that important attacks can actually be observed.

Operationally, the two dominant concerns are data economics and rule lifecycle: ingest is usually priced by volume, so naive “log everything” approaches drown budgets and analysts alike. Mature deployments onboard sources against named detection use cases, retire low-value streams, and treat each rule as maintained code — versioned, tested, and reviewed for drift as the environment changes.

### Key points

- **Primary purpose:** Centralize security telemetry and make cross-system analysis possible.
- **Typical inputs:** Identity, endpoint, server, network, cloud, application, and security-tool logs.
- **Typical outputs:** Alerts, searches, dashboards, cases, timelines, and retained audit evidence.
- **Important limitation:** Installing a SIEM is not the same as operating a detection program; missing or low-quality telemetry creates blind spots.

### Related terms

[Security operations center (SOC)](<https://yellowcube.eu/glossary/security-operations-center/>) · [Security orchestration, automation and response (SOAR)](<https://yellowcube.eu/glossary/security-orchestration-automation-and-response/>) · [Extended detection and response (XDR)](<https://yellowcube.eu/glossary/extended-detection-and-response/>) · [Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>) · [Detection engineering](<https://yellowcube.eu/glossary/detection-engineering/>) · [Threat intelligence platform (TIP)](<https://yellowcube.eu/glossary/threat-intelligence-platform/>)

### Sources

[NIST glossary: Security Information and Event Management](https://csrc.nist.gov/glossary/term/security_information_and_event_management) · [NIST SP 800-92: Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.