Security Information and Event Management (SIEM) systems aggregate logs from across an organization, correlate events, and detect security issues. The market is large (Splunk, IBM QRadar, Microsoft Sentinel, Elastic Security, Datadog Security Monitoring). The use cases are real but the cost is also real.
This page covers what SIEMs actually do and when they make sense.
Collect logs from many sources: firewalls, servers, applications, identity providers, cloud platforms.
Without aggregation, security investigation requires logging into each system individually. With aggregation, all logs in one searchable place.
Logs from different systems have different formats. SIEMs normalize them into a common schema. A "user login" event from Active Directory and from Okta look the same in the SIEM.
Combine events from multiple sources to detect patterns. "User logged in from Russia 10 minutes after logging in from California" — uses logs from both VPN and identity provider.
Pre-built or custom rules that match attack patterns. "Multiple failed logins followed by successful login" might indicate credential stuffing.
When rules match, alert. Either notification, ticket, or workflow.
When an incident happens, investigate. Search across all logs; reconstruct the attack timeline.
PCI-DSS, HIPAA, others require log retention and monitoring. SIEM checks the box.
Has analysts who can write rules, tune detections, investigate alerts.
Many systems generating security-relevant events. Without aggregation, no one sees the whole picture.
Proactive search for indicators of compromise. SIEM is the search tool.
Few systems; few security events. Cloud provider's native logging is enough.
A SIEM without people to investigate alerts is just a log archive. Worse: noisy alerts that nobody triages.
Cloud provider security tools (AWS GuardDuty, Azure Sentinel, Google Chronicle) often suffice.
The dominant traditional SIEM. Powerful query language; extensive ecosystem; expensive.
Cloud-native; integrated with Azure/M365. Strong if you're already in the Microsoft ecosystem.
Enterprise SIEM. Common in regulated industries.
Built on Elasticsearch. Open-source core; commercial enterprise features.
For Datadog customers. Less SIEM-focused but covers many use cases.
Various market positions.
For most cloud-native modern shops, the cloud provider's offering or Elastic is the practical choice.
The hardest part. Out-of-the-box rules generate noise. Tuning:
A well-tuned rule fires rarely but accurately. A noisy rule gets ignored.
Some teams version-control detection rules in git. Test rules; review changes; deploy through CI/CD.
This is mature SIEM operations.
SIEMs are expensive at scale. Costs come from:
Most organizations underestimate cost. The economics matter.
Specifically log volume: high-cardinality logs (every HTTP request, every database query) become expensive fast. Aggregate or filter before sending; don't ingest everything.
Security Orchestration, Automation, and Response (SOAR) tools take SIEM output and automate response. Phishing email reported → SOAR auto-quarantines, scans, etc.
For mature security operations, SOAR + SIEM together is the platform. For most teams, SIEM alone is plenty.
For pure cloud-native shops:
These integrate with cloud platforms; less operational overhead than self-hosted SIEM.
For organizations considering SIEM: