SIEM
Also called security information and event management, SIEM tool, SIEM platform
The system that gathers security logs from across an organisation into one place, raises alerts and lets analysts search them.
SIEM stands for security information and event management. It is the application that collects security data from an organisation's systems, such as sign-ins, network traffic and endpoint activity, and presents it through a single interface.
Analysts use it in 2 ways. Rules inside it raise alerts when the data matches a known bad pattern. And people search it directly, in a query language, when they are investigating or hunting.
AI assistants can now write those queries from a plain question. The risk sits in the result. A query that is wrong in meaning doesn't fail. It comes back empty, and an empty result looks the same as a clean one.
For example
An analyst types a query into the SIEM to list every sign-in to one admin account over the last 30 days.
Put it to use
Where you'll meet SIEM in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.