Glossary term
SIEM (Security Information and Event Management)
Also: Log management platform, Security analytics platform
A platform that centralises security logs, enables long-term retention, runs correlation rules and supports investigation. SIEM is the evidence layer under EDR, XDR and SOC operations and the single largest line item in most security budgets.
SIEM has been through multiple generations (on-prem appliance, cloud-native analytics, data-lake-based). The choice today is rarely between SIEM vendors; it is between architectures: SIEM as primary analytics, SIEM as compliance log store, or no-SIEM with data-lake plus separate analytics.
The decision is expensive to reverse. Log retention, detection content and analyst workflows are deeply coupled to the chosen platform. Exit cost and data portability should be dealbreakers rather than weighted criteria.
In practice
Under DORA and NIS2, SIEM serves as evidence that incident detection and reporting timelines are actually met. A SIEM without tested use cases and runbooks is a compliance cost, not a control. The decision memo should include the operational readiness evidence, not just the product choice.
Related terms
EDR (Endpoint Detection and Response)
A class of endpoint security tools that continuously records endpoint activity and enables detection, investigation and response to threats that evade traditional antivirus. Most enterprise security incidents today are detected or contained at the EDR layer.
XDR (Extended Detection and Response)
A security platform that unifies telemetry across endpoint, network, identity, email and cloud, correlating signals that would otherwise be siloed across point tools. XDR is EDR plus the context to detect multi-stage attacks that a single sensor would miss.
MDR (Managed Detection and Response)
A service that provides outsourced 24/7 monitoring, detection and response on top of an EDR or XDR platform. MDR replaces the need to staff a full in-house security operations centre while keeping incident ownership internal.
SASE
Gartner architecture category combining network (SD-WAN) and security functions (SWG, CASB, ZTNA, FWaaS, RBI) on a single cloud platform. SSE is the variant without SD-WAN.
SBOM
Machine-readable inventory of all components in a software incl. versions, licences and dependencies. Formats: SPDX, CycloneDX, SWID. Mandatory in regulated areas; in the US driven by Executive Order 14028.
Schrems II
CJEU ruling of 16 July 2020 that invalidated the EU-US Privacy Shield and only allowed Standard Contractual Clauses (SCC) under additional safeguards. Consequence: third-country data transfers need a Transfer Impact Assessment (TIA) plus additional protective measures.
SOC 2 Type 2
Audit report by a US public accountant under AICPA SSAE 18 standard, confirming the operating effectiveness of a service organisation's controls over a period (typically 6-12 months). Refers to Trust Service Criteria.
Sovereign cloud
A cloud deployment model that guarantees operational, legal and technical control of data and workloads within a specific jurisdiction (typically the EU). Sovereign cloud answers the concern that hyperscaler deployments remain exposed to foreign jurisdiction, primarily the US CLOUD Act.