What does SIEM stand for?
SIEM stands for Security Information and Event Management. A system that collects and correlates logs and events from many sources to detect threats, alert and support investigations.
A SIEM pulls logs from firewalls, servers, identity providers, endpoints and cloud services into one place, converts them to a common format and correlates them. Its value is the correlation: one failed login is noise, but fifty failed logins followed by a success from a new country is an alert. It also keeps logs long enough for investigations and audits.
SIEM in practice: an example
At 02:10 a firewall logs an inbound connection from an address the company has never seen, and one minute later the domain controller logs a successful administrator sign-in from the same address. Neither device raises an alarm on its own. The SIEM rule that joins the two events does.
What SIEM is confused with
SIEM vs SOAR: what is the difference?
A SIEM detects and alerts; SOAR runs the response. The SIEM tells you an account looks compromised, and a SOAR playbook disables the account and opens the ticket. What SOAR stands for
SIEM vs EDR: what is the difference?
EDR watches one kind of source, the endpoint, in depth. A SIEM is the place where endpoint alerts are joined with network, identity and cloud logs. What EDR stands for
Which exams cover SIEM?
SIEM is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.4 (Security Operations).
- CySA+ CS0-004: 1.3 (Security Operations).
- Network+ N10-009: 3.0 (Network Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. An analyst has to prove that a single attacker touched the VPN gateway, a file server and a cloud mailbox within ten minutes. Which tool is built for that?
- A vulnerability scanner
- A SIEM
- A web application firewall
- A password manager
Show the answer
B. A SIEM. Only the SIEM holds the logs of all three systems on one timeline and can correlate them. The other tools see one system or no logs at all.
2. A SIEM shows a firewall event as happening four minutes after the server event it caused. What should be fixed first?
- The retention period
- The correlation licence
- Time synchronization on the log sources
- The dashboard layout
Show the answer
C. Time synchronization on the log sources. Correlation depends on the order of events. If the sources do not share a time source such as NTP, the timeline is wrong and rules that depend on sequence fail.
Sources: NIST glossary: SIEM tool; NIST SP 800-92, Guide to Computer Security Log Management. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.