Learn in the textbookAdvanced Threat Protection and Network Architecture / Communication Security
DefinitionSIEM gathers the logs produced by servers, network devices and security products in one place and uses correlation analysis (相関分析) to find signs of attack.
ExplanationCorrelation analysis means matching logs from different devices by time, source and similar fields, and linking them as related events. Activity that looks harmless in one device's log can reveal the course of an attack once the pieces are connected. The collected logs also serve as material for tracing what happened after an incident.
AnalogyIt is like a security center that shows every camera feed in the building side by side. Movements you would miss on a single screen reveal a suspicious route once the feeds are put together.
Memory hookThe name combines security information management (SIM) and security event management (SEM), and in Japanese it is read シーム, like "seem."