Security Incident and Event Management (SIEM)
SIEM performs real-time SOC (Security Operations Center) functions like identifying, monitoring, recording, auditing, and analyzing security incidents. It tracks suspicious end-user behavior activities within a real-time IT environment.
SIEM = SIM + SEM
SIEM provides security management services by combining two disciplines:
Supports permanent storage, analysis, and reporting of log data.
Deals with real-time monitoring, correlation of events, notifications, and console views.
Mnemonic — SIEM's Two Halves
"SIM REMEMBERS, SEM REACTS" — SIM is the long-term memory (permanent storage, analysis, reporting of logs). SEM is the reflex (real-time monitoring, correlation, alerts, live dashboards). SIEM = memory + reflex working together.
SIEM Architecture
SIEM ingests data from many sources on the input side, correlates it, and produces actionable output.
System Input — Event Data
Comes from Operating Systems, Applications, Servers, Databases; Security Devices (FW, AV, IDS/IPS, HIPS); and Network Devices (Router, Switch, VPN).
System Input — Contextual Data
Vulnerability scans, User Information, Asset Information, Threat Intelligence.
Inside the SIEM Engine
Data Collection & Normalization (standardizing event data from all these sources), plus Correlation Rules and Data Aggregation (linking related events together and consolidating data).
System Output
Log Analysis, Log Forensics, Real-time Monitoring, Real-time Alerting, Dashboards, Reports.
Mnemonic — SIEM Pipeline
"IN → NORMALIZE → CORRELATE → OUT" — raw logs pour IN from devices/systems, get NORMALIZED into one common format, get CORRELATED against rules and other context, and come OUT the other side as dashboards, alerts, and reports a human can act on.
SIEM Functions — All 12
| # | Function |
|---|---|
| 1 | Log Collection and Log Analysis |
| 2 | Event Correlation |
| 3 | Log Forensics |
| 4 | IT Compliance and Reporting |
| 5 | Application Log Monitoring |
| 6 | Object Access Auditing |
| 7 | Data Aggregation |
| 8 | Real-time Alerting |
| 9 | User Activity Monitoring and Dashboards |
| 10 | File Integrity Monitoring |
| 11 | System and Device Log Monitoring |
| 12 | Log Retention |
Mnemonic — Grouping the 12 Functions
"COLLECT · CORRELATE · COMPLY · CATCH" — group them in fours: Collect (log collection/analysis, application log monitoring, system/device log monitoring, log retention), Correlate (event correlation, data aggregation, object access auditing, file integrity monitoring), Comply (IT compliance and reporting), Catch (log forensics, real-time alerting, user activity monitoring/dashboards) — helps you recall all 12 by bucket instead of a flat list.
SIEM Solutions
| Product | Vendor / Notes |
|---|---|
| Splunk ES | Analytics-driven SIEM to detect and respond to internal and external attacks quickly. |
| ArcSight ESM | Micro Focus. |
| IBM QRadar SIEM | IBM. |
| AlienVault OSSIM | AT&T Cybersecurity. |
| FortiSIEM | Fortinet. |
| SolarWinds Security Event Manager (SEM) | SolarWinds. |
User Behavior Analytics (UBA)
UBA is the process of tracking user behavior to detect malicious attacks, potential threats, and financial fraud. It provides advanced threat detection by monitoring specific behavioral characteristics of employees.
What UBA looks for
UBA technologies identify variations in traffic patterns caused by user behavior — which can come from either disgruntled employees or malicious external attackers using compromised/stolen credentials.
Focuses on events and logs across the infrastructure — correlating what systems and devices report, in real time, against rules.
Focuses on people — building a baseline of normal behavior per user/entity, then flagging deviations that suggest fraud, insider threat, or account compromise.
Mnemonic — SIEM vs UBA
"SIEM WATCHES THE SYSTEM, UBA WATCHES THE PERSON" — SIEM asks "what happened on the network?" UBA asks "does this person's behavior look like themselves today?" Same mission (catch threats), different lens (machine logs vs human patterns).
Why User Behavior Analytics Is Effective
1
Detects malicious insiders and outsiders at an early stage.
2
Identifies possible risk events in the IT infrastructure.
3
Analyzes different patterns of human behavior and large volumes of user data.
4
Monitors geo-location for each login attempt.
5
Detects malicious behavior and reduces risk.
6
Monitors privileged accounts and provides real-time alerts for suspicious behavior.
7
Provides insights to security teams.
8
Produces results soon after deployment.
UBA / UEBA Tools
UBA/UEBA (User and Entity Behavior Analytics) tools collect user activity details from multiple sources and use AI/ML algorithms to perform behavior analysis — aiming to prevent and detect threats before the fraud is actually perpetrated.
| Tool |
|---|
| Exabeam Advanced Analytics |
| LogRhythm UEBA |
| Dtex Systems |
| Gurucul Risk Analytics (GRA) |
| Securonix UEBA |
UBA vs UEBA
UEBA extends UBA by also modeling "entities" (devices, servers, applications) alongside human users — same AI/ML approach, broader scope.
Exam Tips & Tricks
SIEM = SIM + SEM, memorize the split
SIM handles storage/analysis/reporting; SEM handles real-time monitoring/correlation/alerting. Don't mix them up on an exam question asking which one is "real-time."
SIEM performs SOC functions
Identifying, monitoring, recording, auditing, analyzing — this is literally what SOC analysts do, done in software.
12 SIEM functions — group them
Don't try to memorize a flat list of 12; group into collect/correlate/comply/catch buckets as shown in the mnemonic above.
UBA source of risk = insiders AND outsiders
Don't assume UBA is only about external attackers — disgruntled employees are explicitly called out as a UBA target.
UBA/UEBA uses AI/ML
The defining tech behind UBA/UEBA tools is artificial intelligence and machine learning algorithms, not just rule-based correlation (that's more the SIEM/SEM side).
SIEM vs UBA — system vs person
If a question describes "correlating logs from firewalls and routers," that's SIEM. If it describes "detecting when an employee logs in from an unusual geo-location," that's UBA.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| SIEM | Real-time SOC functions: identifying, monitoring, recording, auditing, analyzing security incidents; tracks suspicious end-user behavior. |
| SIM | Security Information Management — permanent storage, analysis, and reporting of log data. |
| SEM | Security Event Management — real-time monitoring, event correlation, notifications, console views. |
| SIEM Input — Event Data | OS/apps/servers/databases; security devices (FW, AV, IDS/IPS, HIPS); network devices (router, switch, VPN). |
| SIEM Input — Contextual Data | Vulnerability scans, user info, asset info, threat intelligence. |
| SIEM Processing | Data collection & normalization, correlation rules, data aggregation. |
| SIEM Output | Log analysis, log forensics, real-time monitoring, real-time alerting, dashboards, reports. |
| SIEM Functions (12) | Log collection/analysis, event correlation, log forensics, IT compliance/reporting, app log monitoring, object access auditing, data aggregation, real-time alerting, user activity monitoring/dashboards, file integrity monitoring, system/device log monitoring, log retention. |
| SIEM Solutions | Splunk ES, ArcSight ESM, IBM QRadar SIEM, AlienVault OSSIM, FortiSIEM, SolarWinds SEM. |
| UBA | Tracks user behavior to detect malicious attacks, threats, and fraud; monitors employee behavioral characteristics. |
| UBA source of anomalies | Disgruntled employees or malicious attackers causing traffic-pattern variations. |
| Why UBA works (8 reasons) | Early insider/outsider detection, risk-event ID, human pattern analysis at scale, geo-location monitoring, reduced risk, privileged account monitoring/alerts, security-team insights, fast results after deployment. |
| UBA/UEBA | Collects user activity from multiple sources, uses AI/ML to detect/prevent threats before fraud occurs; UEBA extends UBA to cover entities too. |
| UBA/UEBA Tools | Exabeam Advanced Analytics, LogRhythm UEBA, Dtex Systems, Gurucul Risk Analytics, Securonix UEBA. |
| SIEM vs UBA (big picture) | SIEM correlates system/device logs and events; UBA models individual/entity behavior baselines and flags deviations. |