Explain like I'm five · Security
What is a SIEM?
Security Information and Event Management, told as a story about the guard room's big screen.
Notes fly in from all over the castle.Doors, windows, the mailbox… thousands a day.
Every note speaks a different language.Reading them one by one never ends.
A SIEM gathers the notes and lines them up on one screen.Same words, in time order.
Gathertake in every note
Translatescribbles and numbers, one language
Line upin time order
Side by side, the burglar appears.Three in a row and the bell rings. The bell goes to the guard room.
The screen doesn't think for itself.No rules written, no bell — even with a burglar in plain view. People write the rules.
In one breath
SIEM = the big screen that gathers and lines up every note, and rings a bell when a rule matches.
Security Information and Event Management. It's the guard room's eyes — but people decide what it looks for.
When grown-ups say it
- Log
- A note. A door opened, someone logged in — one line each part of the castle writes down.
- Ingestion
- Gathering the notes. Getting every source to send its notes to the screen.
- Normalization
- Same language. Turning scribbles and numbers into one format so they can sit side by side.
- Correlation
- Side by side. Joining harmless-looking notes until a burglar shows.
- Detection rule
- When the bell rings. "Window, kitchen, vault within 10 minutes at night." Written by people.
- Alert
- The bell. What goes to the guard room when a rule matches. → the guard room story
- Retention
- The note drawer. Keeping months of old notes, to dig for footprints later.
Next story
A Dog in Every Room →