Glossary
What is SIEM? Security information and event management explained
What is SIEM? SIEM stands for security information and event management: software that collects security-relevant logs from across your systems, correlates them with detection rules, and raises alerts that your security team investigates and responds to. It turns scattered log files into a short list of events worth a person’s attention.
Glossary Published 7 min read
In short
- SIEM meaning: security information and event management: keeping security logs, and watching them for events as they happen.
- What it does: collect, correlate, detect, and support the response.
- What it is not: a team. A SIEM raises alerts; people in a security operations centre (SOC), yours or one you appoint, decide what is an incident.
- Cloud SIEM: the same job delivered as a service, so you send logs instead of running the servers that store and search them.
Why it matters
What is SIEM used for, and why it matters
Every system you run writes logs, and each one on its own says little. An attack usually shows up as a pattern across several of them, such as failed sign-ins on the identity provider, then a successful one from an unusual place, then a new administrator account on a server. Nobody can read millions of lines a day to spot that. SIEM in cyber security exists to do the reading.
A SIEM also gives you one place to answer the questions that follow an alert, or an audit: what happened, when, on which system, and under whose account, instead of a dozen consoles with their own retention periods.
Examples
Examples of what a SIEM detects
- Many failed sign-ins to one account, followed by a success from a country the user has never signed in from.
- Cloud audit logging switched off on a production account outside a change window.
- A new administrator account created on a server at night, with no matching change ticket.
- A server connecting to an address listed in a threat-intelligence feed.
How it works
How a SIEM works, step by step
-
Collect.
Agents, syslog, cloud integrations and APIs bring logs from servers, network devices, identity providers and applications.
-
Parse and normalise.
Each format becomes common fields (user, source address, action, result) so one rule can read every source.
-
Correlate and detect.
Detection rules look for patterns across sources and over time, and can enrich events with reference data such as threat-intelligence lists.
-
Alert.
A match becomes an alert or signal with a severity, so the most serious ones are seen first.
-
Investigate.
An analyst searches the underlying logs to confirm or dismiss the alert.
-
Respond and record.
Confirmed alerts become cases, and automated workflows (often called SOAR) can carry out agreed first steps.
Compared
SIEM vs SOC vs XDR: what each one is
| SIEM | SOC | XDR | |
|---|---|---|---|
| What it is | Software that collects and correlates logs | A team, with its processes and shifts | Detection and response software built around a vendor’s own sensors |
| Main input | Logs from almost any system you connect | Alerts from the SIEM and other tools, plus reports from staff | Telemetry from endpoints, email, identity and network sensors |
| Main output | Alerts, searches, reports, retained logs | Decisions: incident or not, and what to do | Detections with built-in response actions |
| Who owns it | Your security or IT team, or a provider you appoint | Your organisation or a provider you appoint | Usually the security team running the sensors |
| Typical question | “What happened across all our systems?” | “Is this an incident, and who acts?” | “Is this endpoint or mailbox compromised?” |
They are not alternatives. A SOC uses a SIEM as one of its main tools, and many organisations run XDR beside a SIEM: XDR goes deep on its own sensors, while the SIEM keeps the wider record, including custom applications and network devices.
Components
The components of a SIEM
- Collectors: agents and integrations that bring logs in, with a health view that shows when a source goes quiet.
- Parsers: rules that turn raw lines into named fields.
- Storage tiers: fast, searchable storage for recent logs, and cheaper archives for logs kept longer.
- Detection rules: ready-made and custom rules, ideally mapped to a public framework such as MITRE ATT&CK so you can see what is covered.
- Search and dashboards: the analyst’s workbench.
- Case management and workflows: where an alert is followed to a decision.
In a Saudi context
What organisations in Saudi Arabia usually need to log
The National Cybersecurity Authority (NCA) publishes the cybersecurity controls that government entities and critical-infrastructure operators in the Kingdom work to. Their topics include logging and monitoring of security events. Which controls apply to you, and what they require, is set by the authority’s current text, so read it there. As general information, a first SIEM scope in a Saudi organisation usually covers:
Read more
- identity: sign-ins, failed sign-ins and every change to privileged accounts;
- cloud audit logs for each production account or subscription;
- firewalls, VPN and other internet-facing network devices;
- servers and endpoints that hold or reach sensitive data;
- the business applications and databases where a misuse would hurt most.
Security logs also contain personal data, such as user names, addresses and sometimes national ID numbers, so decide early where they are stored. With a cloud SIEM, that means choosing what may leave your network and masking the rest before it is sent; our guide to observability data residency in Saudi Arabia sets out the options.
Relatedguide to observability data residency in Saudi Arabia
Good practice
Common mistakes, and what works better
- Sending every log on day one. Start with a short list, and add sources once those produce alerts someone acts on.
- Leaving every rule switched on. Noisy rules train people to ignore alerts. Review and tune them in the first weeks.
- No named owner for alerts. Decide who triages at night, and which severities wake someone up, before go-live.
- One retention setting for everything. Keep logs analysts search often in fast storage and archive the rest.
- Not noticing silent sources. A source that stops sending looks like a quiet day. Alert on missing logs too.
Where we help
Where Datadog Cloud SIEM and Interkey fit
Datadog Cloud SIEM is a cloud SIEM that runs on Datadog Log Management. Datadog documents Content Packs for security sources, ready-made and custom detection rules, signals sorted by severity, Case Management, and detection coverage by MITRE ATT&CK tactic. It suits teams that want security monitoring on the platform they already use for operations. It is less of a fit where every security log must stay inside the Kingdom, because as of November 2026 Datadog lists no site in the Middle East.
Read more
Interkey sells Datadog licences in Saudi Arabia, connects the log sources, designs storage per log class, writes and tests masking rules, reviews which detection rules are on, and provides technical support from Riyadh. See the SIEM solution page for how we set it up, the Datadog Log Management page for collection, and Datadog security monitoring for the wider security picture.
RelatedDatadog Log Management page
Questions buyers ask about SIEM
What does SIEM stand for in cyber security?
Security information and event management. It covers keeping security logs in one searchable place and watching them for suspicious patterns as they arrive, so the security team sees a short list of alerts instead of raw log files.
Is a SIEM the same thing as a SOC?
No. A SIEM is software; a SOC is the team, with its shifts and procedures, that works the alerts. A SIEM without people to triage it produces alerts nobody reads, and a SOC without a SIEM has little to look at across systems.
Can a Saudi organisation use a cloud SIEM and still meet data residency expectations?
It depends on which logs you send and what applies to you. Decide which log classes may leave your network, mask or drop personal fields before sending, and confirm in writing where the provider stores data. Datadog, as of November 2026, lists no site in the Middle East.
Which logs should go into a SIEM first?
Identity sign-ins and privileged account changes, cloud audit logs, firewalls and VPN, and the servers that hold sensitive data. These catch most early attack steps. Add application and database logs once the first sources produce alerts your team acts on.
How is SIEM licensing usually priced?
Most SIEM pricing follows how much log data you send and how long you keep it searchable, so volume and retention drive the bill. Datadog prices its own products on its pricing page; Interkey quotes the licences together with set-up and technical support in Saudi Arabia.
How long does it take before a SIEM gives useful alerts?
There is no fixed figure. It depends on how many sources you connect, how clean their logs are, how many rules need tuning and how quickly owners are agreed. Starting with a short list of sources and tuning noisy rules early is what shortens it.
From the insights library
Continue in the glossary
More technology terms
Short, plain definitions of the terms buyers meet in monitoring, cloud and data projects.
Glossary termMTTR
How the time to recover from an incident is measured, and what shortens it.
Glossary termWhat is SRE
Site reliability engineering, and how it treats operations as an engineering problem.
GuideNCA ECC: logging and monitoring
What the Essential Cybersecurity Controls ask of event logs and monitoring, and the evidence auditors look for.
SolutionDatadog Cloud SIEM in Saudi Arabia
Log sources, detection rules, storage choices, licences and support.
Related pages
Next step
Plan your first SIEM log sources
Tell us which systems you run, roughly how much log data they produce, and who would triage alerts. We will suggest a first set of sources and quote the Datadog licences, set-up and technical support together.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia