Skip to content
IT Atlas

Security · Security Operations

SIEM

Security Information and Event Management centralises telemetry from across the estate, correlates it into detections, and supports investigation and reporting.

IntermediateUpdated 2026-09-01

Overview

A SIEM ingests logs and events, normalises them into a common schema, applies detection logic, raises alerts and retains data for investigation, hunting and compliance. Modern platforms add entity behaviour analytics and integrate with automation.

SIEM value is determined by data quality and detection engineering, not by licence tier. A platform fed with three noisy sources and default rules produces alert fatigue; one fed with identity, endpoint, email, network and cloud telemetry and tuned detections produces outcomes.

How it works

  1. 01Collectors and agents forward events; the platform parses them into fields and enriches with asset, identity and threat intelligence context.
  2. 02Detections run as scheduled or streaming analytics, generating alerts with severity, entities and MITRE ATT&CK mapping.
  3. 03Analysts triage in a case or incident view that groups related alerts by entity and time, then pivot into raw telemetry.
  4. 04Retention is tiered: hot searchable data for detection, cheaper archive for investigation and compliance.

Why it matters

  • Cross domain attacks are only visible when identity, endpoint and cloud telemetry are correlated in one place.
  • Investigations require history; without retention, scoping a breach is guesswork.
  • Most regulatory and cyber insurance regimes expect centralised logging and monitoring.

Sequence

SOC pipeline
  1. 1Telemetry
  2. 2Collection & normalisation
  3. 3SIEM
  4. 4Detection
  5. 5Triage & investigation
  6. 6Response
  7. 7Tuning & improvement

Layer model

Highest value sources
Identity sign in and audit logsEDR telemetryEmail security eventsDNS and proxy logsCloud control plane audit logs
Supporting sources
Firewall allow/denyVPN authenticationWindows security eventsSaaS audit logsVulnerability data

Security considerations

  • Protect log integrity, forward off host quickly, restrict deletion, and alert on logging that stops.
  • Control access to the SIEM itself; it contains sensitive data about the whole estate.
  • Track detection coverage against a framework such as MITRE ATT&CK and close gaps deliberately.

Common misconfigurations

  • Ingesting everything without a use case, driving cost up and signal down.
  • Default rules left untuned, producing thousands of unactionable alerts.
  • Timestamps and time zones inconsistent across sources, breaking correlation.
  • No alerting on source silence, so a compromised host that stops logging looks healthy.

IT vs OT

OT monitoring adds passive protocol aware sensors because active agents are often impossible on industrial devices. See OT Atlas for ICS monitoring.

IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.

Primary sources