Security Information and Event Management (SIEM) System

The problem SIEM solves

Every device in a system keeps its own logs, in its own format. A real attack rarely leaves a complete trail on a single device — the traces are scattered across firewalls, authentication servers, workstations and applications. SIEM gathers these scattered fragments, normalises them into a common language, and then finds the connections between them.

What determines effectiveness

• Log source coverage — if a device does not send logs, SIEM cannot see it
• Quality of detection rules — default rules rarely suit the specifics of each system
• Handling of false alerts — a poorly configured SIEM generates so many alerts that the operations team can no longer tell genuine alerts apart

Deployment notes

Choosing log sources requires balancing coverage against storage costs. NST surveys the existing system architecture to set the order of priority for integrating data sources.