A Security Information and Event-Management (SIEM) system automates the collection of log files from multiple hosts, servers, and network devices, such as firewalls, in real time to identify potential risks to the network.
The types of functionality from a SIEM system are as follows:
- Aggregation: The SIEM system can move log files and data from multiple sources to a common repository.
- Event Correlation: A SIEM system uses a correlation engine to correlate events from multiple systems. For example, if someone tried to log in to three separate devices, the SIEM server will notify the security administrator of a potential attack. When the same event is duplicated and is logged by different devices, the SIEM system will use event de-duplication to ensure that the event is logged only once.
- WORM Drive Backup: The logs from a SIEM system can...