SIEM Explained

A SIEM, security information and event management platform, collects logs from across an organisation, normalises them, and correlates them to raise alerts on suspicious activity. It is the central nervous system of a SOC. The analyst skill is not running the SIEM, it is writing queries and tuning rules so real threats surface and noise does not.

What a SIEM does

Every system produces logs: servers, firewalls, endpoints, applications. Individually they are noise. A SIEM ingests them all, puts them in a common format, and correlates across them so that a pattern invisible in any single source becomes a visible alert.

The core functions

Why correlation is the point

A failed login is nothing. A failed login on a hundred accounts from one source, followed by one success, then a new process on that host, is an attack. No single log shows it. Correlation across sources is what a SIEM exists to do.

SIEM vs EDR

These get confused. A SIEM aggregates logs from everywhere for a broad view. EDR, endpoint detection and response, lives on individual machines with deep visibility into what happens on them. Modern SOCs use both: EDR for endpoint depth, SIEM for the organisation wide picture.

The popular tools

The query and correlation concepts transfer between them, so learn one deeply.

The real analyst skill

Not clicking around the SIEM, but writing efficient searches, building correlation rules, and tuning out false positives so analysts trust the alerts. An untuned SIEM buries real threats in noise. This is the path from L1 to detection engineering, covered in what a SOC analyst does.

Practise this

Build a free Wazuh lab, feed it logs, generate some attack activity, and write a detection for it. That single project teaches more than any amount of reading. Structured path in the SOC analyst syllabus.