SIEM
In short: A SIEM, or security information and event management system, collects security events from across an organisation so analysts can search, correlate and alert on them. Agent activity belongs there next to sign-in, network and endpoint data, so detection rules and investigations can see agent behaviour in context.
Which controls use this term?
- GOV-14SIEM export. Send agent activity and policy decisions to the security team's SIEM in a structured format, close to real time.
Reviewed by The Register desk