SIEM (Security Information and Event Management)

SIEMs apply correlation rules to identify potential threats and generate alerts for SOC analysts to investigate. They also serve as a central data store for security events, supporting compliance reporting and forensic investigation. Managing the volume and quality of alerts generated by SIEMs, and reducing false positive rates, is one of the most persistent challenges in security operations.