Security information and event management (SIEM) is software that collects log data from many sources in one place, analyzes it and alerts on events that may signal an attack. It gives a security team a central view of what is happening across its systems.

How it works

• Collection: logs arrive from servers, endpoints, firewalls, cloud services, identity providers and applications.
• Normalization: different log formats are parsed into common fields such as user, host, source address and action.
• Correlation and detection: rules and analytics link related events, for example many failed logins followed by a success from a new country.
• Alerting, search and retention: analysts triage alerts, search history during investigations and keep logs for compliance.

A SIEM is only as good as the data it receives and the rules it runs. Gaps in log coverage and noisy rules are common problems.

Why it matters for dark web monitoring

External intelligence becomes useful when it can be matched against internal events. Leaked credentials, infected machine names from stealer logs and indicators of compromise can be fed into a SIEM to check whether the affected accounts or hosts show suspicious activity. Many SOC teams receive dark web alerts through the SIEM so they are handled in the same queue as other detections, often with SOAR playbooks for the follow-up.

Sources: NIST CSRC Glossary: security information and event management, CISA: Guidance for SIEM and SOAR Implementation