SIEM or Shared Monitoring Tools?

About this interactive

An organization runs many monitoring systems, and a lot of people need them. When an application breaks, developers need the log aggregation, the network monitoring and the database monitoring to troubleshoot. The lesson's point is that security monitoring sits on its own. A security information and event management system (SIEM) takes in the security side of everything: firewall logs, endpoint agents, antivirus and intrusion prevention events, sign-ins, changes to who can do what. It gives security a view across the whole infrastructure for researching incidents. Access to it is limited. Someone who caused a problem, an insider for example, could otherwise go into the security logs and cover their tracks. So performance data, error logs and troubleshooting information go to the shared tools, and security events go to the SIEM.

What you'll learn

Decide whether a kind of data belongs in the SIEM, the separate system for security information and events, or in the shared monitoring tools that developers and operations staff use to troubleshoot
Explain why the SIEM is kept apart with limited access: someone causing problems inside the system, such as an insider, must not be able to change the security logs

Aligned to

CompTIA Security+

4.4 Explain security alerting and monitoring concepts and tools

4.9 Given a scenario, use data sources to support an investigation

NIST NICE

K1269 Knowledge of security information and event management (SIEM) tools and techniques

NIST 800-53

AU-9 Protection of Audit Information

AU-2 Event Logging

Key terms

Security Information and Event Management: A system that aggregates and analyzes security event data from across an organization to detect and respond to threats.
Insider Threat: A security risk that originates from individuals who have authorized access to an organization's systems — such as employees, contractors, or partners — and misuse that access either maliciously or through negligence.
Log Management: The process of collecting, storing, analyzing, and monitoring log data generated by systems and applications.

Topics

Siem Monitoring Log Management Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →