A SIEM is a very large, searchable store of logs from every system in a company, with rules on top that raise an alert when a pattern looks wrong. SIEM stands for security information and event management. It is the oldest and most central tool in a security operations centre (SOC).
A log is a line of text that a system writes each time something happens. For example: "Account priya.k logged in from address 49.36.12.7 at 10:14." The login system writes a log line when someone signs in through single sign-on (SSO). The endpoint detection and response (EDR) software writes one when a program starts on a laptop. An endpoint is any device that a person uses, such as a laptop or a phone. The firewall writes one for every connection that it allows or blocks. A large company produces millions of log lines a day.
The SIEM collects all these logs in one place and keeps them for months. So an analyst can search them. Imagine an analyst at an insurance company in Hyderabad. A warning arrives that attackers are using the address 203.0.113.25. She types one search into the SIEM: "Show every connection to 203.0.113.25 in the last 30 days." In under a minute, the SIEM finds two laptops in the claims team that connected to that address last Tuesday. She now knows which two laptops to examine first.
Indian rules also require companies to keep logs. CERT-In, the government's cyber security agency, requires companies to keep their logs for 180 days, in India.
On top of the store, the SIEM runs rules. A rule is a condition written by a security engineer. For instance, "raise an alert if one account fails to log in 20 times in 5 minutes". When a rule matches, the SIEM raises an alert, a message to the analysts that something looks wrong. Rules catch patterns that someone has already described. To catch unusual behaviour that no rule describes, many SIEMs also include user and entity behaviour analytics (UEBA), which learns what is normal for each user.
A SIEM raises far more alerts than people can read. So its alerts go to an AI SOC analyst or to human analysts for triage, the sorting of real alerts from harmless ones. Confirmed attacks go to SOAR, which runs the response steps.
A SIEM is not the same as a log management tool, although both store logs. Engineers use log management to find out why an app is slow or broken. A SIEM stores the same kind of data, but its rules look for attacks.