SIEM
acronymsecuritycloudIT support
Security Information and Event Management: logs from everywhere, correlated into alerts - the security team's central nervous system.
Its economics are its own discipline: ingestion is billed, so what NOT to send becomes an architecture decision.
A SIEM is where logs from everything are supposed to become answers. Collection, normalization into a common schema, correlation across sources, alerting, and retention for the investigation that has not happened yet: the value is entirely in the correlation, because a firewall denial and a failed login and a new admin account are unremarkable alone and a pattern together.
The failure mode is well documented and still common. Ingest everything, write hundreds of rules, and the output becomes a queue nobody can read, which is alert fatigue arriving by a specific route. The organizations that get value tend to log deliberately against the detections they actually intend to run, rather than collecting comprehensively and hoping meaning emerges from volume.
Two practical realities deserve stating. Licensing usually scales with data volume, so the architecture decision and the budget decision are the same decision, and teams routinely discover this after the pilot. And a SIEM is only as good as its time synchronization: correlating events across sources whose clocks disagree produces sequences that never happened, which is why NTP hygiene is a security control rather than an operational nicety.