What is SIEM?

Security information and event management is the platform that collects logs from across an organisation, normalises them, stores them and runs detection rules over them to raise alerts. Splunk, Microsoft Sentinel and Elastic are common examples.

A SIEM is only as good as what it ingests and how its rules are written. For a CTI team it is where indicators get searched retrospectively and where intelligence becomes detections.