Security Information and Event Management System

最新推荐文章于 2025-08-06 23:01:26 发布

转载最新推荐文章于 2025-08-06 23:01:26 发布 · 715 阅读

文章标签：

#云计算 #云计算机制

Cloud Computing 专栏收录该内容

94 篇文章

订阅专栏

安全信息及事件管理系统（SIEM）整合了安全管理中的安全信息管理和安全事件管理两大功能，能够从多个位置收集有关企业安全态势的相关数据，并从单一视角进行数据分析，帮助识别潜在的恶意活动。SIEM系统通过关联不同技术记录的事件、展示多种事件源的数据并提供来自其他来源的支持信息，辅助管理员验证警报的准确性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Security Information and Event Management System

Security information and event management (SIEM) combines security information management (SIM) and security event management (SEM) functions into one security management system. SIEM collects relevant data about an enterprise's security posture in multiple locations and analyzes all the data from a single point of view, providing the capability to spot trends and patterns that may be the result of malicious activity.

The SIEM system complements intrusion detection and prevention systems (IDPS) by correlating events logged by different technologies, displaying data from many event sources, and providing supporting information from other sources to help administrators verify the accuracy of alerts. SIEM data is usually recorded locally and sent to separate systems, such as centralized logging servers and the master SIEM system.

Advanced SIEM systems correlate event, threat, and risk information to detect attacks, possibly in realtime, and support forensic investigations and produce compliance reports as a result of activity monitoring.

Figure 1 - An example of a SIEM architecture.

Figure 1 shows a SIEM architecture providing for log collection, analysis and forensics, event correlation, and IT compliance evidence for auditing and monitoring. Local SEM sensors located within the organization’s networks collect and forward events to a master SIEM.