SIEM (Security Information and Event Management)

A SIEM (Security Information and Event Management) collects, normalises and correlates events from multiple sources to support detection, investigation and evidence. It may combine identity, endpoint, server, application, network and cloud data, but only sees information that arrives with sufficient quality. Installing connectors or default rules does not guarantee coverage; clocks, fields, retention, volume and asset context need control. Deployment should define priority sources, use cases, owners, escalation and privacy boundaries. Rules are tuned with authorised tests and observed false positives. Useful measures include source health, ingestion delay and investigation time. An empty dashboard may mean no incident, an unsuitable rule or a failed source; these states must not be treated as equivalent.