IT glossary
SIEM (Security Information and Event Management)
A SIEM, or security information and event management, is software that collects logs from across your systems and flags the patterns that look like an attack.
Every system you run keeps a record of what happened: logins, file access, firewall traffic, administrator changes. Individually those records are close to meaningless. A SIEM’s job is to gather them, line them up on a single timeline, and notice when a sequence across three separate systems adds up to something worth a phone call.
Why it matters to you
Two things. First, most incidents are only visible in the joins: a login from an unusual country, then a mailbox rule created, then a payment request sent. No single tool sees all three. Second, when something does happen, the logs are how anyone reconstructs what was touched and what was not. Without them, you are left telling clients and insurers that you cannot say either way, which is a much worse conversation.
The part that gets skipped
A SIEM is a collection and correlation engine, not a security team. On its own it produces alerts, and the great majority of alerts are ordinary behaviour that happens to look odd. Somebody has to triage them, decide which ones matter, and act. Buying the platform without buying the attention is the most common way organizations spend real money and end up no safer.
This is why a SIEM is usually bought as part of a monitored service rather than as software. happier IT runs its own security operations centre in Canada, staffed by our own employees, which is the part of the arrangement that does the actual work.
SIEM, EDR and antivirus
They answer different questions. EDR, endpoint detection and response, watches behaviour on individual laptops and servers, and can isolate one. A SIEM watches everything else too: cloud accounts, firewalls, identity systems, and the endpoints’ own reports. You would not use a SIEM instead of EDR. In a small environment you might reasonably start with EDR and identity monitoring, and add broader log collection once there is someone to read it.
What to ask
Which sources are actually connected, how long logs are kept, where they are stored, and who reviews the alerts overnight. “Log retention: 30 days” is a real answer. “Full visibility” is not.