SIEM

A SIEM ingests logs from endpoints, identity providers, cloud control planes, network devices and applications, parses them into a common schema, indexes them for search, and runs detection rules that raise alerts. Splunk, Microsoft Sentinel, Google SecOps and Elastic are common.

It exists so analysts can investigate across sources in one place and detections can correlate events (a login from a new country followed by a mailbox rule). It is also where retention and audit requirements are met.

Where it goes wrong: ingest cost drives teams to drop the logs they later need, parsing gaps silently break rules, and default content floods the queue. Modern designs separate a streaming pipeline (Kafka, normalisation, enrichment) from tiered storage (hot search, cheap cold lake). Expect to design one in interviews.