SIEM (Security Information and Event Management)
- Description
-
A type of security software that collects and analyzes telemetry data from various sources, including endpoint devices, firewalls, intrusion detection/prevention systems, and servers. The goal of a SIEM is to provide real-time analysis of security events generated by these devices and report security-related information.
SIEM systems rely on log collection agents, such as NXLog Agent, to ingest data from heterogeneous sources. Besides collecting telemetry data, an adequate agent filters, enriches, and transforms the data into the SIEM’s taxonomy before sending it to the SIEM. This initial processing at the log source ensures the SIEM receives clean data that it can analyze efficiently.
- Also known as
-
SIEM solution, SIEM tool, SIEM system
- See also