{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/siem","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/siem/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/siem/"},"term":{"en":"SIEM","da":"SIEM"},"aka":{"en":["Security Information and Event Management"],"da":["Security Information and Event Management"]},"domain":["security"],"cluster":"controls","status":"current","era":2005,"summary":{"en":"A system that gathers logs from across the organisation in one place and raises an alarm when something looks wrong.","da":"Et system, der samler logs fra hele organisationen ét sted og slår alarm, når noget ser forkert ud."},"body":{"formal":{"en":"A platform that collects log entries from many systems, puts them in one common format, links related events together and checks them against rules to produce alarms for people to investigate.","da":"En platform, der indsamler logposter fra mange systemer, bringer dem på et fælles format, kobler sammenhængende hændelser og holder dem op mod regler for at skabe alarmer, som mennesker skal undersøge."},"plain":{"en":"Like a security guard's desk with screens from every camera in the building, plus a helper who points out when the same stranger shows up at three doors.","da":"Som en vagts skrivebord med skærme fra alle bygningens kameraer, plus en hjælper, der gør opmærksom på, når den samme fremmede dukker op ved tre døre."},"inPractice":{"en":"At an accounting firm, the SIEM notices five failed attempts to log in to a partner's account, followed by a successful one from another country ten minutes later, and opens an alarm for the on-call analyst.","da":"Hos et revisionsfirma ser SIEM'en fem mislykkede login på en partners konto efterfulgt af et vellykket login fra et andet land ti minutter senere og opretter en alarm til den vagthavende analytiker."},"whyItMatters":{"en":"One odd event rarely means much; seeing events from many systems side by side is what turns scattered clues into an attack spotted in time.","da":"Én enkelt underlig hændelse betyder sjældent meget; det er, når man ser hændelser fra mange systemer side om side, at spredte spor bliver til et angreb opdaget i tide."}},"deepDive":{"en":"The term was coined by Gartner analysts Mark Nicolett and Amrit Williams in 2005, merging two earlier product categories: security information management (SIM), focused on log collection, retention and compliance reporting, and security event management (SEM), focused on real-time correlation and alerting. A SIEM pipeline has five stages. Collection uses agents, syslog (RFC 5424, usually over TLS per RFC 5425 rather than lossy UDP), Windows Event Forwarding, and API pulls from cloud and SaaS services. Parsing and normalisation map vendor-specific fields to a common schema - historically CEF or LEEF, today often the Elastic Common Schema, Microsoft's ASIM or the Open Cybersecurity Schema Framework (OCSF, launched in 2022). Enrichment adds context such as asset owner, user department, geolocation and threat-intelligence matches. Correlation and analytics apply rules and models. Storage tiers (hot, warm, cold or archive) balance query speed against retention cost.\n\nCorrelation logic ranges from single-event rules (a new member added to Domain Admins) through threshold and sequence rules (many failed logons followed by a success from the same source within ten minutes) to statistical baselines and user and entity behaviour analytics (UEBA), which flag deviations such as a user downloading far more data than their peer group. Sigma has become a vendor-neutral rule format that can be compiled to the query languages of different SIEMs (KQL, SPL, EQL and others), enabling shared detection content. Increasingly, SIEMs integrate SOAR (security orchestration, automation and response) so that playbooks can enrich an alert, open a ticket, disable an account or isolate a host automatically.\n\nThe dominant constraints are economic and operational. Licensing is typically by ingest volume (GB/day) or events per second, which pushes organisations to drop \"noisy\" sources - often exactly those needed in an investigation. Parsers break silently when a vendor changes its log format, so a source can appear healthy while its fields are empty. Detection engineering needs version control, testing against sample data and coverage mapping to MITRE ATT&CK. A SIEM with default rules and no tuning produces alert volume without insight.\n\nRetention is driven by investigation needs and regulation: incident investigations routinely need months of history because dwell times are measured in weeks, while logs containing personal data must respect GDPR storage limitation. NIST SP 800-92 (2006) is the classic log-management guide, and ISO/IEC 27002:2022 controls 8.15 (logging), 8.16 (monitoring activities) and 8.17 (clock synchronisation) are the usual anchors. A SIEM is a platform, not a function: without a SOC or on-call analysts to triage its output, it is an expensive log archive.","da":"Begrebet blev skabt af Gartner-analytikerne Mark Nicolett og Amrit Williams i 2005 ved at sammensmelte to ældre produktkategorier: security information management (SIM), der fokuserede på logindsamling, opbevaring og compliancerapportering, og security event management (SEM), der fokuserede på korrelation og alarmering i realtid. En SIEM-pipeline har fem trin. Indsamling sker via agenter, syslog (RFC 5424, helst over TLS efter RFC 5425 frem for UDP, der kan tabe beskeder), Windows Event Forwarding og API-kald mod cloud- og SaaS-tjenester. Parsing og normalisering mapper leverandørspecifikke felter til et fælles skema - tidligere CEF eller LEEF, i dag ofte Elastic Common Schema, Microsofts ASIM eller Open Cybersecurity Schema Framework (OCSF, lanceret i 2022). Berigelse tilføjer kontekst som aktivejer, brugerens afdeling, geolokation og træf i threat intelligence. Korrelation og analyse anvender regler og modeller. Lagringsniveauer (hot, warm, cold eller arkiv) afvejer søgehastighed mod omkostningen ved opbevaring.\n\nKorrelationslogikken spænder fra regler på enkelthændelser (et nyt medlem føjet til Domain Admins) over tærskel- og sekvensregler (mange mislykkede logon efterfulgt af et vellykket fra samme kilde inden for ti minutter) til statistiske baselines og user and entity behaviour analytics (UEBA), der markerer afvigelser, fx en bruger, der henter langt mere data end sine kolleger i samme rolle. Sigma er blevet et leverandørneutralt regelformat, der kan oversættes til forskellige SIEM'ers forespørgselssprog (KQL, SPL, EQL m.fl.), så detektionsindhold kan deles. SIEM'er integreres i stigende grad med SOAR (security orchestration, automation and response), så playbooks automatisk kan berige en alarm, oprette en sag, spærre en konto eller isolere en maskine.\n\nDe dominerende begrænsninger er økonomiske og driftsmæssige. Licenser afregnes typisk efter indlæst datamængde (GB pr. dag) eller hændelser pr. sekund, hvilket presser organisationer til at fravælge \"støjende\" kilder - ofte netop dem, man har brug for i en efterforskning. Parsere går stille i stykker, når en leverandør ændrer sit logformat, så en kilde kan se sund ud, mens felterne er tomme. Detection engineering kræver versionsstyring, test mod eksempeldata og kortlægning af dækning mod MITRE ATT&CK. En SIEM med standardregler og uden tuning giver alarmmængde uden indsigt.\n\nOpbevaringstiden styres af efterforskningsbehov og regulering: efterforskning af hændelser kræver rutinemæssigt måneders historik, fordi dwell time måles i uger, mens logs med personoplysninger skal respektere databeskyttelsesforordningens princip om opbevaringsbegrænsning. NIST SP 800-92 (2006) er den klassiske vejledning i logstyring, og ISO/IEC 27002:2022 kontrol 8.15 (logning), 8.16 (overvågningsaktiviteter) og 8.17 (tidssynkronisering) er de sædvanlige ankre. En SIEM er en platform, ikke en funktion: uden en SOC eller vagthavende analytikere til at triagere outputtet er den et dyrt logarkiv."},"edges":[{"type":"requires","to":"cs/log","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/audit","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/threat-intelligence","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/soc","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-92 - Guide to Computer Security Log Management","tier":"standard","publisher":"NIST"}],"draft":true}