https://lesitedefrancois.be/en/tags/logging/Recent content in Logging on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/siem/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/siem/<p><strong>SIEM (Security Information and Event Management)</strong> is a platform that aggregates security telemetry from across an organisation&rsquo;s infrastructure, normalises it into a common schema, applies correlation rules and behavioural analytics to detect threats, and retains the data for investigation and compliance reporting. The name combines two earlier disciplines: <strong>SIM (Security Information Management)</strong> — long-term log retention, compliance reporting, and forensic search — and <strong>SEM (Security Event Management)</strong> — real-time alert correlation and incident detection. Modern SIEMs do both simultaneously, serving as the primary visibility layer for a Security Operations Centre (SOC). Leading platforms include Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel, Elastic Security, Exabeam, and LogRhythm; all share the same fundamental architecture despite differing in query language (SPL for Splunk, KQL for Sentinel, EQL/KQL for Elastic, AQL for QRadar), correlation engine design (search-based vs dedicated CEP engine), and deployment model (on-premises, SaaS, or hybrid).</p>