SIEM system

What is a SIEM system in simple words

SIEM (Security Information and Event Management) is a system that collects all security events from the entire company's IT infrastructure (logs of servers, firewalls, antiviruses, databases), analyzes them and alerts about suspicious activity. In simple words, it is like a security control center that sees what is happening across the entire network at once.

Imagine that you have an apartment building with hundreds of apartments, and each has motion, smoke and water leak sensors installed. If each sensor works separately, you will get thousands of signals, and it will be impossible to sort them out. SIEM is a dispatch room that collects all signals, analyzes them and shows only those that are really important. For example, if a smoke sensor went off in one apartment and a motion sensor in the next one, it could be a fire, and the dispatcher will immediately call the firefighters.

SIEM combines the functions of security information management (SIM — long-term storage and analysis of logs) and security event management (SEM — real-time monitoring and correlation). This allows not only storing data about all events but also instantly responding to threats.

SIEM systems collect logs from firewalls, DLP systems, antiviruses, servers, databases, network equipment and cloud platforms. The main task of SIEM is real-time incident detection, conducting investigations and generating reports for regulators. SIEM is a key component of security operations centers (SOC).

Without SIEM, security analysts are forced to manually review logs from each device, which is practically impossible in large organizations where millions of events are generated daily. SIEM automates this process, allowing focusing on truly important threats.

SIEM architecture

A typical SIEM architecture includes several key components that work in a single chain:

• Collection agents (collectors): Installed on event sources (servers, network devices, applications) and collect logs in real time. Agents can operate in passive mode (listening to network traffic) or active mode (receiving data via API).
• Central normalization server: Brings logs from different sources to a unified format. This is a critically important stage, since each source uses its own log format. Without normalization, event correlation would be impossible.
• Correlation engine: The heart of SIEM, which analyzes events and identifies attack patterns. Correlation allows combining seemingly unrelated events into a single incident. For example, an unsuccessful login attempt followed by a successful login from a different IP address can be a sign of a breach.
• Event storage: Provides long-term storage of all events for investigations and compliance with regulatory requirements. Storage can be organized based on big data technologies (Elasticsearch, Hadoop) for efficient work with huge volumes of information.

Correlation analysis is a key SIEM function that allows combining events from different sources to identify complex attacks. For example, if the system detects port scanning from one IP address, and a few minutes later an unsuccessful login attempt from the same address, SIEM can combine these events into one incident and increase its priority.

Modern SIEMs use machine learning and behavioral analysis (UEBA — User and Entity Behavior Analytics). UEBA allows identifying anomalies in the behavior of users and systems that may indicate insider threats or account compromise. For example, if an employee who usually works from 9 to 18 suddenly starts actively downloading data at 3 a.m., the system may regard this as suspicious behavior.

To ensure secure log transmission, VPN is often used, which guarantees data confidentiality during transfer between distributed offices and cloud environments.

SIEM and regulatory requirements

SIEM helps to fulfill the requirements of 187-FZ for CII facilities and 152-FZ on personal data. For critical information infrastructure facilities, keeping security event logs and their long-term storage is mandatory, which is impossible without a SIEM system.

FSTEC Order No. 31 requires registering events and storing logs for at least a year. SIEM automatically collects, stores and indexes logs, providing quick access to them for investigations and audits.

The design service helps you choose the optimal SIEM architecture and configure correlation rules taking into account the specifics of your organization. A properly configured SIEM system not only improves security but also reduces the workload on SOC analysts. Read more about monitoring approaches in the technologies section.