SIEM
Security information and event management
A system that collects, normalizes and correlates logs and events from many sources to detect, alert on and investigate security incidents; its detections are only as good as the logs it receives.
Covered in
Guide
Create security logs someone can investigate
Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.
Guide
Turn runtime events into a tested investigation and containment path
Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.