What is security information and event management?

Security information and event management (SIEM) is a configurable system of record that collects, aggregates and analyzes security event data from on-premises and cloud environments. SIEM processes security event data for the purposes of threat detection, investigation and response. It natively supports data normalization and offers user-configurable detection content and reporting to orchestrate threat mitigation and satisfy compliance requirements. These solutions are delivered via a SaaS platform or client-hosted on-premises or private cloud.

The common features for this market include:

• Allow for mixed methods of data collection that include both streaming event data and static telemetry, such as file processing, API-retrieved or system configuration data

• Multiple deployment options to include on-premises, cloud-hosted, cloud-native or SaaS

• Normalization, enrichment and risk-score data ingestion from third-party systems, such as threat intel sources or configuration management databases (CMDBs)

• Provision of case management processes and support for incident response actions

• Workflow augmentation features, such as automation, orchestration of common tasks and use of AI

• The ability to use various data science techniques to generate detections on a wide range of behaviors, such as user, network, application or object, that indicate attack activities

• Threat intelligence platform (TIP) capabilities to manage intelligence feeds and supply contextual information about threats that may include native threat intelligence

• A marketplace that allows clients to subscribe to threat content and facilitates integration with third-party technologies

• Federated search into diverse vendor SIEM environments that allows for analysis and functioning using a centralized interface

• Decentralized search functionality to query events from outside the vendor data repository and pull in additional enriching information, where appropriate

• Extended detection and response (XDR) interoperability that includes the use of endpoint detection and response (EDR), network detection and response (NDR), or other extended telemetry and response capabilities

• Third-party data lake platform integrations for storage and search

Buyers typically have mature security operations (SecOps) programs with staff and the experience to deploy, maintain and operate a SIEM for threat detection, investigation and response. Less mature SecOps programs buy SIEM to maintain their security data’s custody while outsourcing management and monitoring to a third-party co-managed security monitoring service provider.