What is Security information and event management?
In short
A security information and event management (SIEM) system collects and correlates logs from servers, network devices and applications across an organization to detect suspicious activity and alert security staff.
Key takeaways
- It supports investigations and compliance reporting by keeping logs in one place.
- Rules need tuning to reduce false positives so real alerts aren't missed.
- It is often monitored by a security operations center.
Where it's tested
ISC: Incident Response & Monitoring — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A company can tolerate losing at most 15 minutes of transaction data in a disaster. Which metric does this define, and what does it drive?