SIEM: The Security Camera System for Your Entire Network

The 30-second explanation

Imagine every door, corridor and car park has a camera. A SIEM is the control room that watches all the feeds together and tells a guard when something looks off.

How it works

1. 1

   1. Sources

   Endpoints, network, cloud and identity produce logs.

2. 2

   2. Collect

   Logs are gathered and normalised in one place.

3. 3

   3. Correlate

   Rules and analytics connect related events.

4. 4

   4. Alert

   An analyst reviews the alert and investigates.

Every computer, server and application keeps a diary of what happens: who signed in, what was opened, what connected where. These diaries are called logs. On their own they are scattered and overwhelming. A SIEM gathers all those diaries in one place, then connects the dots — one failed sign-in means nothing, but fifty failed sign-ins from another country followed by a success looks like a break-in. A person, usually a SOC analyst, then decides whether the alert is a real problem or a false alarm.

Real-world example

How to spot it

• A source that goes quiet

  A system that stops sending logs can mean a gap — or tampering.

• Noisy, low-value alerts

  A detection rule firing constantly usually needs tuning, not ignoring.

• Alerts without context

  A good alert tells you who, what and where — not just that something happened.

• Blind spots in coverage

  Important systems that were never connected for logging at all.

What to do

1. 1Start by logging the systems that matter most: identity, endpoints and anything internet-facing.
2. 2Tune noisy rules early — an ignored alert is worse than no alert.
3. 3Review what isn't logged at all, not just what already is.