What is SIEM?

A system that collects security logs from across an organisation and raises alerts on suspicious patterns.

In plain English

SIEM stands for security information and event management. It gathers logs from servers, applications, firewalls and other sources, stores them in one place, correlates events and alerts the security team. Analysts then triage the alerts and investigate. Its value depends on the quality of the logs and the tuning of the rules.

Example

Many failed sign-ins from one address followed by a success triggers an alert for review.

Easy to confuse with

• Observability: Observability is about understanding how a system behaves for engineers. A SIEM focuses on spotting security threats.

Where you will meet it

This idea belongs to the subject area of these practice tests. We do not publish or predict real exam questions.

• ISC2 CC practice tests
• Cisco CCST Cybersecurity practice tests

Related terms

• IDS and IPS: An IDS detects suspicious traffic and raises an alert. An IPS sits in the path and can block it.
• Metrics, logs and traces: The three main kinds of telemetry: numbers over time, event records, and the path of a single request.
• Observability: How well you can understand what is happening inside a system from the data it produces.

Written and checked by the Be Ready Education team, last reviewed 2 November 2026. General study information, not professional advice. Providers change names and rules, so confirm details on the official documentation. Not affiliated with, endorsed by or sponsored by any certification vendor or exam body. Certification names, exam codes and product names are trademarks of their respective owners and are used only to identify the exam a practice product prepares for. Our questions are original and are not actual exam questions.