What Is SIEM? Security Information and Event Management Explained

Every system in your business keeps a diary. Your firewall logs blocked connections. Microsoft 365 logs sign-ins. Your servers log admin actions. Your EDR tool logs suspicious processes. Individually, each log tells a tiny part of the story. Together, they can reveal an attack in progress, if someone is looking at them in one place.

That’s the job of a SIEM. It’s one of the most talked-about tools in security, and one of the most misunderstood. This guide explains how SIEM works in plain English, what it costs, how it compares with EDR and SOAR and how to tell whether your company is actually ready for one.

What SIEM means

SIEM stands for security information and event management. It combines 2 older ideas:

• Security information management (SIM): Collecting and storing logs for search, reporting and compliance.
• Security event management (SEM): Watching events in near real time and alerting on suspicious activity.

NIST’s glossary, drawing on its log management guide (SP 800-92), describes SIEM software as a program that provides centralized logging capabilities for a variety of log types. Modern SIEM platforms go further, adding correlation, threat intelligence, dashboards and investigation tools on top of that central log store.

How SIEM works, step by step

1. Collect. Agents, APIs and connectors pull logs from sources such as firewalls, identity providers, cloud platforms, email, endpoints, servers and business applications.
2. Normalize. Logs arrive in many formats. The SIEM parses them into common fields, such as user, IP address, device, action and time, so they can be compared.
3. Store. Data is indexed for fast search, with older data often moved to cheaper storage for retention.
4. Correlate. Rules and analytics connect events across sources. One failed login is noise. 50 failed logins followed by a success from a new country, then a mailbox forwarding rule, is an incident.
5. Alert. Matching patterns create alerts, ranked by severity, for analysts to review.
6. Investigate. Analysts search across all logs to build a timeline: what happened, which accounts and devices were involved and what the attacker touched.
7. Report. Dashboards and reports support compliance audits and leadership updates.

Accurate timestamps matter for all of this. Correlation only works if every system agrees on the time, which is why standards like PCI DSS require time synchronization across systems.

Key takeaway: SIEM’s value isn’t storing logs. It’s connecting events across many systems so a pattern no single tool would notice becomes a clear alert.

Which logs matter most

You don’t have to send everything on day 1. In May 2025, CISA and Australia’s ACSC released joint guidance on implementing SIEM and SOAR, including a practitioner guide on priority logs for SIEM ingestion. It covers sources such as EDR tools, network devices, domain controllers and Active Directory, Windows and Linux systems, cloud platforms, containers, databases and mobile device management.

For a typical small or midsize business, a practical first wave looks like this:

Start with identity and email logs. They catch the attacks small businesses see most often.

SIEM vs EDR vs SOAR vs XDR

These tools overlap, which causes confusion:

• EDR watches individual devices deeply. It sees what processes run on a laptop but not what happens in your cloud apps. See EDR vs antivirus.
• SIEM watches broadly across all log sources, including the alerts EDR produces.
• SOAR (security orchestration, automation and response) automates responses. CISA’s guidance describes SOAR as automating predefined actions based on detected anomalies, such as disabling an account or isolating a device.
• XDR (extended detection and response) is a vendor-integrated platform combining endpoint, email, identity and cloud signals, often from one vendor’s products.

Many modern platforms blur the lines, bundling SIEM, SOAR and XDR features together. The practical question is whether you need visibility across many systems from different vendors. If you do, that’s SIEM territory.

How SIEM is priced

SIEM costs vary enormously by vendor and data volume. The common pricing models are:

• Data ingestion: Charged per gigabyte of logs ingested per day or month. Microsoft Sentinel, for example, offers pay-as-you-go pricing by data volume or commitment tiers starting at 100 GB per day, and some data sources, such as Microsoft 365 audit logs and Defender alerts, are free to ingest.
• Per device or per user: A flat price per endpoint, server or employee.
• Events per second: Common in older on-premises SIEMs.
• Managed SIEM or SOC-as-a-service: A provider runs the SIEM and monitors alerts for a monthly fee.

Also budget for retention. Compliance often requires keeping logs for months or years. PCI DSS, for example, requires retaining audit log history for at least 12 months, with the most recent 3 months immediately available for analysis. Long retention in “hot” searchable storage gets expensive, so most platforms offer cheaper archive tiers.

The biggest cost is usually people, not software. A SIEM generates alerts that someone must triage, tune and investigate. Untuned, it can bury a small team in false positives.

Is your company ready for SIEM?

SIEM is powerful, but it’s not a first security purchase. You’re likely ready when most of these are true:

• You have the basics. Multi-factor authentication, EDR, patching and backups are in place.
• You have many log sources. Several cloud apps, an identity provider, firewalls, servers and endpoints from different vendors.
• Compliance requires it. PCI DSS requires daily review of security event logs and automated mechanisms for log review. Frameworks like SOC 2, HIPAA and CMMC also expect logging and monitoring.
• Customers or insurers ask. Security questionnaires increasingly ask how you monitor and retain logs.
• Someone can respond. You have security staff, an IT provider or a managed detection service ready to act on alerts.

You’re probably not ready yet if:

• You have fewer than about 20 employees with a single productivity suite and no compliance driver. Built-in security alerts in your suite and EDR may cover most of your needs.
• Nobody has time to review alerts. Consider a managed service instead of buying a SIEM yourself.

Where to start with SIEM

1. Define the goal. Compliance logging, threat detection or both. This shapes what you collect.
2. Check what you already own. Some cloud and productivity suites include SIEM-like features or discounted SIEM ingestion. Our guide on how to secure Microsoft 365 covers the built-in tools.
3. Pick 3 to 5 log sources. Identity, email, EDR and firewall are strong first choices.
4. Turn on a small set of high-value alerts. For example, impossible travel sign-ins, new admin accounts, mailbox forwarding rules and disabled security tools.
5. Assign ownership. Decide who reviews alerts daily and who’s on call. Link it to your incident response plan.
6. Tune for 30 to 60 days. Suppress noisy alerts and add sources gradually.
7. Consider managed options. A managed SOC or managed IT service provider with security monitoring can run the SIEM for you.

If you follow the NIST Cybersecurity Framework, SIEM supports its Detect and Respond functions, and it fits naturally with a zero trust approach where every access is verified and logged.

Conclusion

A SIEM turns scattered logs into a single, searchable story of what’s happening across your business. It’s essential for larger organizations and anyone with strict compliance duties, but it only works with good log sources, tuned alerts and people ready to respond. Get the basics in place first, start with identity and email logs and grow from there, or let a managed provider run it for you.

Sources

• NIST CSRC glossary: Security information and event management — definition from NIST SP 800-92
• CISA: Guidance for SIEM and SOAR implementation (May 2025) — executive, practitioner and priority log guidance
• ASD’s ACSC: Priority logs for SIEM ingestion — recommended log source categories
• Microsoft Learn: Plan costs and understand Microsoft Sentinel pricing — ingestion-based pricing, commitment tiers and free data sources
• PCI DSS Requirement 10 text, via Microsoft Learn — daily log review, automated review and 12-month retention