SIEM (Security Information and Event Management)
A SIEM aggregates, normalizes, and correlates log data from across an organization's infrastructure to detect threats and support incident response. Popular SIEMs include Splunk, Microsoft Sentinel, and Elastic Security. Threat intelligence enrichment significantly improves SIEM detection accuracy.
Frequently asked questions
What is SIEM (Security Information and Event Management)?
A SIEM aggregates, normalizes, and correlates log data from across an organization's infrastructure to detect threats and support incident response. Popular SIEMs include Splunk, Microsoft Sentinel, and Elastic Security. Threat intelligence enrichment significantly improves SIEM detection accuracy.
How is SIEM (Security Information and Event Management) related to IOC (Indicator of Compromise)?
IOC (Indicator of Compromise) in short: An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Related terms
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Threat Intelligence
Threat intelligence is evidence-based knowledge about cyber threats, including observed infrastructure, behaviors, campaigns, and likely intent. It combines source observations with context so security teams can make a specific detection, triage, containment, or response decision.
SOC (Security Operations Center)
A Security Operations Center is a team (and facility) responsible for continuously monitoring, detecting, investigating, and responding to cybersecurity incidents. SOC analysts rely on threat intelligence, SIEM platforms, and playbooks to triage alerts efficiently.
Try it on a real indicator
Look up any IP, domain, URL or file hash in the indexed records.