Also known as: Security Information and Event Management
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
The core value is correlation across sources. A failed login is unremarkable; a failed login followed by a successful one from a different country, then privileged group modification, is a pattern no single system would flag alone.
SIEMs are notorious for cost and alert fatigue. Ingest-based pricing punishes exactly the comprehensive logging that makes investigation possible, and poorly-tuned rules generate volumes of alerts that overwhelm analysts — the practical failure mode being alerts that are technically firing but functionally ignored.
Security Operations Center
A security operations center (SOC) is the team and function responsible for continuously monitoring an organisation's environment for security threats, triaging alerts, and initiating incident response.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Indicator of Compromise
An indicator of compromise (IOC) is an observable artifact — such as a file hash, IP address, domain, or registry key — that suggests a system may have been breached.
EDR
EDR (Endpoint Detection and Response) is security software installed on endpoints that continuously records process, file, and network activity, detects suspicious behaviour, and enables remote investigation and containment.