SIEM (Security Information and Event Management)

What SIEM (Security Information and Event Management) means in practice

A SIEM answers a question no individual product can: what happened across the whole environment, in order, over a period longer than any single platform retains. Firewalls, identity providers, endpoints, email gateways, servers and SaaS applications each hold a fragment of an incident. A SIEM is where those fragments are joined.

The core functions are ingestion, normalisation, correlation, alerting, investigation and retention. Ingestion pulls logs from connectors. Normalisation maps different vendors' formats onto a common schema so a query can span them. Correlation rules and analytics detect patterns across sources — a password spray followed by a successful sign-in followed by a mailbox rule creation, for example. Retention keeps the data long enough to investigate an intrusion that began months before it was noticed, which is common.

Microsoft Sentinel is the Azure-native option and integrates directly with Microsoft Entra ID, Defender XDR, Office 365 and Azure resources, as well as third-party sources. Its pricing is consumption-based on data ingested and retained, which makes log source selection an engineering and cost decision at the same time. Ingesting everything is rarely the right answer; ingesting identity, email, endpoint and edge telemetry usually is.

For Australian organisations, retention has a compliance dimension as well as an investigative one. Audit log retention expectations appear in the Information Security Manual, in APRA guidance for regulated entities, and in most cyber insurance questionnaires. Default Microsoft 365 audit retention is shorter than many organisations assume, and extending it is a licensing and configuration decision that should be made deliberately.

A SIEM without analysts is a very expensive log archive. The platform decision should follow the operating model decision: who watches it, on what roster, with what authority to act.