SIEM and Logging

Security Information and Event Management (SIEM) is the central nervous system of network security operations. It collects, normalises, correlates, and analyses log data from across the entire infrastructure to detect threats, support investigations, and meet compliance requirements.

---

Why Logging Matters

Every device, application, and service on a network generates logs. These logs are the evidence trail for security events:

• Who accessed the system
• What they did
• When it happened
• Where (source/destination)
• How (protocol, method, tool)

Without centralised logging, security teams are blind. Logs scattered across hundreds of devices are operationally useless.

---

Log Sources in Network Security