SIEM
Security Information and Event Management — centralizes log collection, correlation, and alerting.
A SIEM centralizes logs from across the environment and correlates them so a sequence harmless in isolation (one failed login here, a new admin account there) surfaces as one alert. Its value is precisely that cross-source correlation — single-source rules belong in the source tool. Modern SIEMs blend with data lakes and UEBA for behavioral analytics, and feed SOAR for automated response.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →