Security information and event management (SIEM) — SY0-701

WHAT IT IS

A security information and event management (SIEM) system is "a program that provides centralized logging capabilities for a variety of log types" (NIST SP 800-92). Its defining function is combining two capabilities: collecting and storing log records from across an environment, and finding relationships between those records to surface meaningful signals.

---

Mental model

Think of a SIEM as a central nervous system for security visibility. Individual systems each generate their own "a record of the events occurring within an organization's systems and networks" (NIST SP 800-92). Left in place, those records are isolated and unrelated. A SIEM pulls them into one location, then performs correlation — "finding relationships between two or more log entries" (NIST SP 800-92) — so that patterns invisible in any single source become visible across all of them.

The sequence moves in one direction:

Each arrow represents a distinct function; removing any one of them leaves you with something that is not a SIEM.

---

When to use it

Scenario	SIEM	Stand-alone log management
Need to store and retrieve raw log records	Yes	Yes
Need to find relationships across log sources	Yes	No
Need to generate alerts from multi-source patterns	Yes	No
Need long-term archival only	Possible, but over-engineered	Better fit

The key differentiator: log management is "the process for generating, transmitting, storing, analyzing, and disposing of log data" (NIST SP 800-92). It encompasses the lifecycle of log data. A SIEM is a specific system built on top of that capability, adding cross-source correlation and alert generation. All SIEMs do log management; not all log management is a SIEM.

---

COMMON MISCONCEPTION

Candidates often treat a SIEM as a detection tool that actively blocks threats. It does not. A SIEM surfaces "notification that a specific attack has been directed at an organization's information systems" (CNSSI 4009-2015, via NIST glossary) — it generates alerts. Acting on those alerts (blocking, isolating, remediating) is a separate function performed by humans or other systems.

A related trap: equating a SIEM with an intrusion detection or prevention system. The SIEM's work is correlation and alerting across log data. Inline traffic inspection and blocking belong to different categories of control.

A third misconception is that a SIEM only monitors for events that already qualify as an "incident" — "an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system" (FIPS 200, via NIST SP 800-53 Rev. 5). In practice, a SIEM processes all observable events; it is the correlation layer that helps distinguish routine events from those that may constitute an incident. The SIEM does not wait for an incident to already be declared before collecting data.

---

How it shows up on the exam

The cognitive target here is distinguishing SIEM from adjacent technologies that share partial capabilities: log managers, IDS/IPS, and endpoint detection tools. Candidates who understand only the "logging" half of SIEM may confuse it with any system that collects records. Candidates who overweight the "alerting" half may confuse it with inline controls.

Signal phrases that point toward SIEM:

• "centralized logging" combined with "correlation" or "alerting across sources"
• "aggregation" of logs from multiple, heterogeneous systems
• generating an alert when a pattern spans multiple devices or log types
• "finding relationships between log entries" (the NIST definition of correlation)

Pause when a question describes a single-source analysis task — that leans toward log management or audit review, not SIEM specifically. Pause again when a question describes active blocking or inline traffic manipulation — that is not what a SIEM does.

---

Related concepts

• Security monitoring
• Log aggregation
• Alert tuning