What is a SIEM?

SIEM in plain English

SIEM stands for Security Information and Event Management. The idea behind it is simple: almost every IT system keeps a record of what happens – a digital logbook that notes who signed in when, which file was opened, or which connection the firewall blocked. These records are called logs, and every system produces large volumes of them. A SIEM brings them together and analyzes them as a whole.

An everyday comparison: imagine the monitoring center of a security company, where the signals from all the cameras, door contacts, and motion detectors in a building come together. An open window on its own is unremarkable. An open window at three in the morning, followed by movement in the server room, is not. A SIEM recognizes exactly these kinds of connections – only in your IT environment.

How a SIEM works

1. Collect: The SIEM receives logs from many sources – firewalls, servers, authentication services such as Active Directory, VPN gateways for remote work, cloud services, and security solutions for laptops and servers, such as EDR.
2. Normalize: Every system writes its logs in its own format. The SIEM converts them into a uniform format so they can be compared.
3. Correlate: Rules and analytics link events from different sources to one another. An example: many failed sign-ins, then a successful one – and shortly afterwards, a new administrator account.
4. Alert: When the SIEM detects a suspicious pattern, it generates an alert for experts to assess – often in a Security Operations Center (SOC), a team that specializes in monitoring.
5. Retain: The data is kept for a defined period so that what happened can still be traced weeks later.

The key point: a SIEM is only as good as the data sources connected to it, the rules configured in it, and the people who handle the alerts. A SIEM whose alerts nobody reviews is like a monitoring center with nobody on duty.

A practical example

Here’s a typical scenario: A staffing agency with several branch offices has connected its firewall, VPN, authentication services, and file servers to a SIEM. One Saturday morning, a clerk’s user account signs in via VPN. On its own, that’s unremarkable – employees sometimes work on weekends.

Shortly afterwards, however, thousands of job application documents are copied from the file server via this account within a few minutes. The SIEM links the two events and alerts the IT service provider’s on-call team. The account is locked and the connection terminated. The investigation shows that the password came from a phishing email and that the account wasn’t protected with multi-factor authentication. Because the logs are complete, it’s possible to determine exactly which data was affected – which is important for the report to the data protection authority.

Why does this matter for businesses?

Attackers often go undetected for a long time because individual events look harmless. It takes a combined view of all events to expose them. The earlier an attack is noticed, the sooner it can be stopped – before data is exfiltrated or systems are encrypted.

Then there are reporting obligations. Under the GDPR, personal data breaches must in many cases be reported to the supervisory authority within 72 hours of becoming aware of them, where feasible. Companies covered by NIS2 even have to submit an early warning of significant security incidents within 24 hours to the joint reporting office of the BSI (Germany’s Federal Office for Information Security) and the BBK (Federal Office of Civil Protection and Disaster Assistance). But you can only report an incident you’ve detected. In addition, the BSI Act explicitly requires operators of critical facilities to use attack detection systems – and a SIEM is a typical building block for this.

Because logs contain personal data, data protection and – if you have one – your works council (the elected employee representative body) should be involved in the project from the start.

What to look out for

• Start with the most important sources: Connect authentication services, firewalls, VPN, email and cloud services, and your endpoint protection first.
• Define suitable rules: Determine which attack scenarios should be detected, and adapt the rules to your environment.
• Handle the alerts: Clarify who assesses alerts – including at night and on weekends. If you don’t have your own team, an external SOC service is an option.
• Reduce false positives: With too many unimportant alerts, the real alarms get buried.
• Synchronize clocks: All systems should use the same, exact time; otherwise, events can’t be correlated cleanly.
• Define retention: Decide how long logs are stored – long enough for investigations and in line with data protection requirements.

How Rootsektor can help

As a Rapid7 partner, we advise you on Incident Command (formerly InsightIDR), Rapid7’s next-gen SIEM, and support you through selection, implementation, and operation – from connecting log sources to fine-tuning detection. We use Red Teaming & APT Simulation to test whether your SIEM actually detects a realistic attack. If a security incident occurs, we analyze event logs as well as data from SIEM and EDR systems as part of our digital forensics work and reconstruct how the attacker proceeded; whether your logging is sufficient for this is something we clarify in advance as part of Forensic Readiness. In an acute incident, you can reach us at +49 2932 465265-0 – outside our business hours of Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST), the same number connects you to our 24/7 emergency hotline.