SIEM software collects logs from many systems into one place, converts them to a common format, and analyzes them so you can search, correlate events and raise alerts. NIST's log management guide defines it as a program that provides centralized logging capabilities for a variety of log types.
What are the core functions?
NIST SP 800-92 describes a typical SIEM as one or more log servers that perform analysis plus database servers that store logs. The functions it names are collection, event filtering and aggregation, log normalization and analysis.
Normalization is the least glamorous and the most important. NIST gives the example of dates: one source writes a twelve-hour time and another a twenty-four-hour time, so the tool converts both to a single representation and categorizes them consistently. Without that, you cannot search across sources or correlate by time.
Storage is the other function that gets underestimated. NIST says log management is essential to ensuring records are stored in sufficient detail for an appropriate period of time, and that logs support auditing, forensics, internal investigations and baselines. It also lists regulations that lead organizations to store and analyze logs, including FISMA, HIPAA, SOX, GLBA and PCI DSS.
How does data get in?
NIST describes two collection styles. In the agentless approach, the SIEM server receives logs from hosts without special software on them, either by pulling (authenticating to each host and retrieving logs) or by hosts pushing to the server. In the agent-based approach, a program on each host filters, aggregates and normalizes a particular log type and sends the result in near real time. A generic agent may handle formats such as syslog.
NIST's stated advantage of agentless collection is that nothing needs to be installed, configured and maintained on each host. Agents give you more control at the source and can reduce load on the central server. Whichever you choose, someone has to maintain it, and that work is a large part of running a SIEM.
What should you check before buying?
Treat a trial as a test of your own data, not a demo of theirs.
Source coverage. List the ten log sources you most need: identity provider, cloud audit logs, endpoints, firewalls, VPN, key SaaS applications, source control. Check that each has a supported parser or a supported way to build one, and ask who maintains it when the vendor of the source changes its format.
Time handling. NIST recommends time synchronization such as NTP across log sources, since out-of-sync clocks make correlation unreliable. Check how the tool treats events whose timestamps are wrong or late.
Search and retention. Test a search you will actually run, across the retention period you need, and time it. Ask what happens to old data: is it searchable, archived, or deleted?
Detection content. Ask how rules are written, tested and versioned, and how many you will have to build yourself. A rule that cannot be tested before deployment will produce noise.
Log integrity. NIST's guide has a section on log security. Check access controls, whether administrators can alter stored logs, and how you would show an auditor they were not changed.
Cost model. Work out your daily volume first, then ask what the pricing counts: ingestion, storage, queries or hosts. Costs that scale with data push teams to drop logs, which defeats the purpose.
Exit. Ask how you export your data and rules if you leave.
A constructed example
A 120-person company shortlists two tools. It builds a one-week test with real logs from its identity provider, cloud audit trail and VPN. The test has three tasks: find every failed sign-in followed by a success for the same user within ten minutes, search for one user's activity across all three sources for the last 60 days, and export the matching rule. One tool needs a custom parser for the VPN logs, which no one on the team can write. The other handles the VPN but is slow on the 60 day search. The team now has a real trade-off to weigh, rather than a feature list.
How to check or apply this
- List your log sources and the questions you need answered before looking at products.
- Decide on collection method per source, and who will maintain agents or connectors.
- Synchronize clocks everywhere that sends logs.
- Run a time-boxed trial with your own data and three real searches.
- Estimate volume and retention, and model the cost at twice that volume.
- Test export, role-based access and log tamper protection.
- Write the first five detection rules before you sign, and see how long it takes.
Quick check
Is a SIEM the same as log management?
Log management stores and organizes logs. A SIEM adds normalization, correlation and alerting aimed at security events. NIST's guide treats log management as the broader discipline.
Do we need a SIEM to meet compliance requirements?
Many frameworks require logging and review, not a particular product. Check the exact control wording and agree your approach with your assessor.
Sources
- NIST SP 800-92, Guide to Computer Security Log Management
- NIST CSRC Glossary, Security Information and Event Management
Last reviewed: 18 October 2026.
