An agency SOC is comparing products that keep logs searchable, correlate events into alerts, or execute response steps. Which description is the SIEM?
Select an answer to reveal the explanation.
Short Explanation
You’re comparing a warehouse, a dispatcher, and a robot arm, which do different jobs. The SIEM correlates stored events into alerts; searchable retention, response playbooks, and packet dropping are neighboring roles.
Full Explanation
The SIEM job in this comparison is correlation and alerting across events that have already been stored. A platform that correlates stored events and raises alerts across those sources is the SIEM description. A log store that keeps events searchable but does not correlate them into alerts provides log management: retention and search, without the alert. A playbook engine that runs response steps after someone decides what action to take provides SOAR, executing a response after the decision rather than performing the correlation step itself. A firewall that drops packets on the forwarding path enforces a path policy; it does not correlate agency logs. Hand-searching an archive is not the same job as a platform raising a correlated alert. Exam caveat: one product may bundle storage, correlation, and playbooks, so classify it by the job the question asks for—in this case, correlation into alerts. Operational check: confirm the platform creates alerts from related events across agency sources, rather than only archiving logs or only running a response playbook.