Time to Contain

SIEM

A SIEM collects and searches security logs and runs detection rules over them. Some now include SOAR features. Whether a response platform needs a SIEM in front depends on whether it can take detections directly from EDR, identity, email and cloud tools.

Definition

A SIEM is where many detections start. If the response platform sits behind it, the SIEM's alert quality and latency set a floor on time to contain.

Platforms that are themselves a SIEM or XDR remove one hop. Others accept alerts by webhook or connector and leave the SIEM question open.

SIEM in Microsoft Sentinel's documentation

Microsoft's Sentinel pricing page describes a cloud SIEM built on Azure Monitor Log Analytics workspaces, with analytics rules, KQL hunting, automation rules and a data lake tier for long-term data. vendor claim microsoft.com, read

The example names a vendor and its own page. A vendor's use of SIEM may differ from the definition above; the rubric uses the definition on this page.