SIEM

A SIEM, or security information and event management system, collects logs from many systems so a team can spot and investigate attacks in one place.

SIEM: SIEM stands for security information and event management. It is a system that gathers logs, which are records of what happened, from servers, devices, apps and networks, then looks for patterns that suggest an attack. It lets a team search and investigate in one place.

Every system keeps records: who logged in, which files changed, what connections were made. On their own they are a mountain of text. A SIEM collects them, compares them and raises an alert when many small events add up, such as one user logging in from two cities within minutes. The name sounds heavy, but the idea is plain: gather the diary of every system and read it together.

A SIEM is for organisations with many systems, and it needs people who read and tune it. For a home or small shop the practical version is to turn on login alerts and check the activity page of your email and bank. Small server owners can at least keep logs and review failed login attempts. Those who skip logs often learn about a break-in only from customers.

Tips

• Turn on sign-in alerts and check recent activity on your email and key accounts.
• If you run a server, keep its logs and look at failed login counts now and then.
• Report unusual account activity to your provider quickly.

Related terms