SIEM
Security Information and Event Management — a platform that aggregates, correlates, and retains security event logs across an organisation for threat detection, compliance reporting, and forensic investigation.
What is SIEM?
SIEM (Security Information and Event Management) is the central log aggregation and correlation platform in a modern SOC. It ingests events from firewalls, endpoint agents, identity systems, cloud APIs, and application logs — normalising them into a common schema so analysts can write detection rules, build dashboards, and run threat hunts across the entire environment in a single query interface.
Modern SIEM platforms combine real-time streaming ingestion with long-term retention (often 12–24 months for compliance) and support scheduled or interactive queries against cold storage. Detection engineering teams maintain libraries of SIEM rules — written in languages like Sigma, SPL, KQL, or Elasticsearch Query Language — that fire alerts when telemetry matches known attacker behaviours or anomalous baselines.
SIEM differs from XDR in its emphasis on retention, compliance evidence, and customisable detection engineering over out-of-the-box correlation. Most mature security programmes run both: SIEM for long-term data and bespoke detection, XDR for real-time multi-source correlation and automated response. AiRAT builds custom SIEM deployments using Elasticsearch/OpenSearch and Splunk — tuning detection libraries to the client's threat model rather than shipping vendor defaults.
Examples in production
Compliance reporting
A SIEM retains 18 months of authentication logs and generates automated evidence packs for PCI-DSS and ISO 27001 audits — reducing audit preparation from weeks to hours.
Threat hunting
An analyst queries the SIEM for DNS requests matching a newly published IoC list, pivoting across 90 days of logs to identify devices that communicated with the malicious domain before the indicator was published.
Detection rule library
500+ Sigma rules maintained in version control, tested against a synthetic telemetry dataset on every merge, and automatically deployed to the production SIEM via CI/CD pipeline.
Explore further
Questions about SIEM
What is the difference between SIEM and XDR?
SIEM is primarily a log aggregation, retention, and compliance platform with flexible custom detection. XDR focuses on real-time multi-source correlation, enrichment, and automated response. Modern SOCs use both: SIEM for long-term retention and compliance evidence, XDR for detection fidelity. The boundary is blurring as vendors add features to both — evaluate based on your primary use case.
What log sources should a SIEM ingest?
Priority log sources: endpoint agents (process, network, file events), firewall and network telemetry, identity provider logs (Active Directory, Okta), cloud API activity logs (AWS CloudTrail, Azure Monitor), and application authentication logs. Start with the highest-signal sources for your threat model rather than ingesting everything and drowning in noise.
How do you reduce SIEM alert fatigue?
Alert fatigue reduction requires detection engineering discipline: tune rule thresholds against your baseline, suppress known-good automated processes, enrich alerts with asset criticality and user context before they reach analysts, and enforce a detection lifecycle — rules that generate no true positives in 90 days should be retired or retuned.
Running a system that uses SIEM?
We build production-grade cybersecurity systems for regulated enterprises.