A SIEM collects security events from across your systems, correlates them, and raises an alert when the combination looks like an attack rather than normal activity.
The short answer
SIEM stands for security information and event management. It gathers logs from endpoints, applications, cloud accounts and identity systems, normalises them into a common format, applies correlation rules, and alerts when a pattern matches known attacker behaviour. It is also where the evidence auditors ask for is retained.
A single log line rarely means anything. A failed login is noise. A failed login from a new country, followed by a successful one, followed by a permission change, is an incident. Correlation is the part that turns the first into the second.
On this page
How a SIEM works
What it ingests
| Source | Events that matter |
|---|---|
| Identity and access | Sign-ins, MFA challenges, privilege changes, new admin accounts |
| Endpoints | Malware detections, unusual process activity, device policy violations |
| Cloud accounts | Configuration changes, new IAM roles, storage made public, key usage |
| Web and API layer | Blocked attacks, unusual request patterns, credential stuffing attempts |
| Applications | Authentication failures, data exports, administrative actions |
Why correlation matters
Each of the events below is unremarkable alone. Together they describe an account takeover in progress, and only a system holding all of them can see that.
Where frameworks require it
| Framework | Status | What it expects |
|---|---|---|
| PCI DSS v4.0 | Required | Requirement 10: log all access to system components, review logs, retain 12 months. |
| ISO 27001:2022 | Expected | Annex A 8.15 logging and A 8.16 monitoring activities. |
| SOC 2 | Expected | CC7.2 monitoring for anomalies, and evidence that alerts are investigated. |
| DPDP Act, 2023 | Implied | Detection and timeline evidence needed for a 72-hour breach report. |
How Osto runs SIEM
Most SIEM projects fail at collection, because logs arrive from a dozen vendors in a dozen shapes and someone has to build the pipeline. Osto avoids that step: endpoint, IAM, ZTNA, WAF, cloud posture and vulnerability data are already generated by the same platform, so correlation happens across modules by default rather than after an integration project. That is also what makes cross-domain detection possible, where an event in one module only becomes meaningful next to an event in another.
Free security assessment
Detection that sees across the whole stack
Endpoint, identity, WAF and cloud events correlated in one platform, with the retained evidence auditors ask for.
Get a free security assessment Book a platform walkthroughNo log pipeline to build · Cross-module correlation · One platform, everything
Frequently asked questions
What does SIEM stand for?
Security information and event management. A SIEM collects security events from across an organisation’s systems, normalises them, correlates them, raises alerts and retains the record for investigation and audit.
What is the difference between a SIEM and log management?
Log management stores and searches logs. A SIEM adds correlation and detection logic on top, so related events across different systems are linked and alerted on. Every SIEM includes log management; the reverse is not true.
Do small companies need a SIEM?
They need the outcome rather than a large deployment: centralised logs, detection across systems, and a retained evidence trail for audit. Traditional SIEM products are heavy for small teams, which is why platforms that generate and correlate their own telemetry fit better.
How long should logs be retained?
It depends on the framework. PCI DSS requires twelve months with three months immediately available. SOC 2 and ISO 27001 do not fix a period, so retention follows your own documented policy, and twelve months is the common choice.