SIEM

Security information and event management: a platform that collects logs from firewalls, servers, Active Directory, EDR and other sources, correlates them and raises alerts, so a SOC can investigate from one place. The hard part is not buying it but making sure the important systems actually send their logs, logs are kept long enough, and rules are tuned to cut false alarms.

Further reading: csrc.nist.gov

All terms