SIEM

Problem

Security-relevant events occur across: Firewalls Servers Entra ID Applications Endpoints Looking at each system separately makes coordinated attacks difficult to see.

Solution — SIEM

SIEM stands for Security Information and Event Management. It collects security logs and connects related events to detect suspicious activity. Microsoft Sentinel provides this in Azure: data connectors bring in logs, analytics rules search for patterns such as repeated failed logins followed by a suspicious success, and matching events generate alerts that can be grouped into incidents for investigation.

Identity logs ─┐
Firewall logs ─┼→ SIEM → detection
Server logs ───┘

Core idea: SIEM combines security telemetry so patterns across systems can be detected.