What is SIEM and how does SIEM work?

Security Information and Event Management (SIEM) is a software solution that aggregates and analyzes activity from many different resources across your entire IT infrastructure.

SIEM collects security data from network devices, servers, domain controllers, and more. SIEM stores, normalizes, aggregates, and applies analytics to that data to discover trends, detect threats, and enable organizations to investigate any alerts.

SIEM provides two primary capabilities to an Incident Response team:

1. Reporting and forensics about security incidents
   
   
2. Alerts based on analytics that match a certain rule set, indicating a security issue