Security Information and Event Management (SIEM) is a solution approach for detecting IT security incidents. SIEM makes it possible to collect event log data from a wide variety of sources in a central location and to automatically detect and report anomalies and rule violations in this data based on previously defined use cases. The SIEM combines components of Security Information Management (SIM) and Security Event Management (SEM). The latter includes the collection, normalization, aggregation and correlation of events as well as immediate notification when potential security incidents are detected. Through the SIM component, evaluations can be performed in real time using visualizations or downstream using reports on the collected data. These evaluations can provide valuable information, for example, about company-wide configuration changes, access to sensitive data, use of privileged accounts, or even an overview of the company’s current threat situation.

The current threat situation in the area of cybercrime is more than tense. Whether it’s ransomware, phishing, drive-by downloads or social engineering, hackers are leaving no stone unturned to compromise networks, gain access to corporate data and extort ransoms.
Cyber security teams need to be able to respond quickly and efficiently to existing threat situations. SIEM systems deliver critical value to an organization’s information security by being able to comprehensively collect security-related data, aggregate it into a centralized repository, and automatically detect anomalies and rule violations based on pre-defined use cases.

This offers IT security teams a decisive advantage – because the time required to identify an acute threat (mean time to detect) can be significantly reduced by a SIEM.

A SIEM solution collects company-wide log data, usually with the help of software agents. The underlying sources include servers, endpoints, routers, firewalls, intrusion detection and prevention systems (IDS and IPS), and applications. The collected data is compiled and processed in a central management station and correlated with each other. The correlated data is visualized on individually configurable dashboards. In this way, cyber defense analysts can identify IT security incidents at an early stage – in areas that conventional IT security solutions cannot take into account at all.

Overall, the following different operating models are possible:
In-house SIEM: You as the customer operate the system yourself, if necessary with the support of our SIEM expert team, which provides the missing know-how.
Managed SIEM: As your IT security service provider, we operate your SIEM system in one of our Cyber Defense Centers and process your data there.

Co-Managed SIEM: As your cyber defense partner, we operate the SIEM system or just parts of the system at your site. The data remains in your network at all times.

Our modern SIEM solutions, such as ArcSight, are also available as “Software as a Service” (SaaS) solutions, which significantly reduce the operating costs for you as the end customer.  The integration of additional components such as ArcSight Intelligence (UEBA) or Cyberres Galaxy (Threat Intelligence) also offers you great added value in the area of IT security. Customers with special protection needs can also install a SIEM solution on premise.

Yes! With a SIEM, you ensure the ability to analyze and preserve evidence, ensuring compliance and regulatory requirements are met, among other things.
One of the ways you achieve this is by using a SIEM solution to automate your entire data collection and analysis process, and to capture and verify data compliance across your entire enterprise infrastructure. You’ll be able to generate real-time compliance reports that reduce your security management overhead. At the same time, a SIEM can identify existing vulnerabilities and potential breaches that need to be addressed.