SIEM

What is a SIEM?

A SIEM (Security Information and Event Management) is a platform that centrally collects, normalises, correlates and analyses security-relevant logs and events from across an organisation so that cyber threats can be detected, investigated and reported. It provides near real-time insight into what is happening at network, system and application level. That makes a SIEM the core detection and investigation tool of a SOC and a standard layer in Defense in Depth and incident response. In industrial environments it is increasingly used to monitor OT networks as well.

🧠 What does a SIEM do?

The term SIEM was coined in 2005 by Gartner analysts Mark Nicolett and Amrit Williams. They merged two existing product categories:

• SIM (Security Information Management) - long-term collection, retention and analysis of log files, mainly for reporting and forensic investigation
• SEM (Security Event Management) - real-time monitoring, correlation and alerting on suspicious events

A modern SIEM combines both and adds dashboards, threat intelligence and often behavioural analytics. The core question it answers: which separate events together form an attack?

🛠️ What functions does a SIEM provide?

A SIEM does not discover vulnerabilities itself. It can, however, link CVE data from a vulnerability scanner or asset inventory to alerts, and match indicators of compromise from threat intelligence against logged IP addresses, domains and hashes.

🏭 How is a SIEM used in OT environments?

SIEM systems come from IT, but they are increasingly deployed in OT. That calls for a different approach, because much OT equipment barely logs anything. A PLC rarely sends syslog, and classic SCADA components often run on older Windows versions. In practice, OT data therefore comes mainly from these sources:

Because PLCs reveal little themselves, passive monitoring with an OT NDR sensor is usually the most important source. Such a sensor sees, for example, a program download or a firmware update and forwards it to the SIEM as an alert. By linking SIEM data to the zones and conduits model and the network’s segmentation, detection becomes context-aware. An RDP connection from the office network into a controller zone is then immediately suspicious.

Typical OT challenges are:

• Availability comes first - agents on HMIs and controllers are often not permitted or not certified by the vendor.
• One-way traffic - logs flow from OT to IT, sometimes through a data diode, never the other way round.
• Time synchronisation - without aligned clocks via NTP, correlation is unreliable.
• Limited OT knowledge in the SOC - an IT analyst will not recognise a changed setpoint as an attack. An OT SOC or shared playbooks solve this.
• Quiet attackers - techniques such as Living Off The Land, used by Volt Typhoon, only stand out as deviations from normal administrative behaviour.

🔄 What is the difference between SIEM, SOAR, XDR and NDR?

Many vendors now bundle these functions into a single platform. The distinction remains useful when choosing, though: a SIEM ingests data from any vendor’s systems and retains logs for a long time, whereas XDR is strongest at fast detection within its own ecosystem.

🔐 What do NIS2 and standards require for logging?

• NIS2 and the Dutch Cybersecurity Act - since 15 August 2026, Dutch essential and important entities must report a significant incident: an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after the incident notification. Without central logging, that first assessment within 24 hours is hardly feasible.
• Implementing Regulation (EU) 2024/2690 - requires, among others, cloud, data centre and managed service providers to have monitoring and logging procedures, logs of authentication, privileged access and network traffic, synchronised clocks and redundant logging systems. The regulation does not set a minimum retention period.
• IEC 62443-3-3 - SR 2.8 (auditable events), SR 2.9 (audit storage capacity), SR 2.11 (timestamps), SR 6.1 (audit log accessibility) and SR 6.2 (continuous monitoring).
• ISO 27001:2022 - Annex A controls 8.15 (logging), 8.16 (monitoring activities) and 8.17 (clock synchronisation). The Dutch government baseline BIO builds on these.
• PCI DSS 4.0 - requirement 10.5.1 demands at least twelve months of log history, with the latest three months immediately available. The standard only covers payment card data, but this ratio is widely used as a benchmark beyond it.

🧭 How do you set up a SIEM for IT and OT?

1. Start from risks and use cases - choose ten to twenty scenarios, such as unknown remote access, a new administrator or a PLC download outside maintenance. Map them to MITRE ATT&CK for ICS.
2. Select log sources per use case - prioritise firewalls, Active Directory, jump servers, engineering stations and OT NDR alerts.
3. Sort out time and transport - synchronise all clocks and forward OT logs via a collector in the DMZ to the SIEM.
4. Define retention - for example three months directly searchable and twelve months or more in cheaper storage. Record the period in policy and take the GDPR (AVG) into account.
5. Tune detection rules - start with a learning period and reduce false positives before alerts reach the SOC.
6. Connect to response - link alerts to the Incident Response Plan, to SOAR playbooks and to the reporting chain towards the CSIRT.
7. Test regularly - use threat hunting and exercises to check whether the SIEM actually sees real attacks.

Costs and licensing. SIEMs are usually priced by data volume (GB per day), by events per second (EPS) or per asset or user. Log volume is therefore the biggest cost driver. Filter noise such as verbose debug logs before ingestion. Well-known solutions include Microsoft Sentinel, Splunk (part of Cisco since 2024), Elastic Security, IBM QRadar (whose SaaS version moved to Palo Alto Networks in 2024), OpenText ArcSight, Google Security Operations and the open-source Wazuh. The once popular open-source OSSIM is no longer maintained.

❓ Frequently asked questions

What does SIEM stand for?

SIEM stands for Security Information and Event Management. Gartner introduced the term in 2005, combining Security Information Management (log management) with Security Event Management (real-time detection). A SIEM is therefore both a log archive and a detection platform.

Does an OT environment need its own SIEM?

An OT environment usually does not need a separate SIEM, but it does need its own log sources, use cases and detection rules within the existing SIEM. Many organisations forward OT alerts via a collector in the DMZ to the central SIEM and involve an OT specialist in triage. Where strict separation is required, some companies do run a separate SIEM instance in the OT domain.

How long should a SIEM retain logs?

A SIEM should retain logs for as long as your policy and applicable regulations require. NIS2 and its implementing regulation do not prescribe a fixed period, but they do require a predefined and protected retention period. In practice, twelve months is common, with the latest three months directly searchable.

Is a SIEM mandatory under NIS2?

NIS2 does not mandate a specific SIEM product, but it does require incident handling, monitoring and reporting within 24 hours, 72 hours and one month. For most medium-sized and large organisations, a SIEM, in-house or via a managed SOC, is the practical way to meet those requirements. Smaller organisations can sometimes rely on the logging of an XDR or MDR service.

Can a SIEM detect attacks on a PLC?

A SIEM can detect attacks on a PLC if it receives the right data, usually from an OT NDR sensor that analyses network traffic to the PLC. When the SIEM combines that alert with login data from an engineering station or jump server, a complete picture emerges. PLCs themselves often provide too few logs for direct detection.

What is the difference between a SIEM and a SOC?

A SIEM is technology that collects and correlates logs and generates alerts. A SOC is the team and processes that assess, investigate and follow up those alerts. A SIEM without a SOC mostly produces unread alerts.

📌 In summary

A SIEM collects and correlates security logs from IT and OT into one central view, so that threats are detected early, incidents can be investigated and you can act within the NIS2 reporting deadlines. In OT, a SIEM works best together with OT NDR sensors, synchronised clocks and clear use cases. It supports frameworks such as ISO 27001, BIO, IEC 62443 and CSIR.