# Introduction

### Security Information Management (SIM) <a href="#docs-internal-guid-916163f5-7fff-e486-35f0-a042fef859d9" id="docs-internal-guid-916163f5-7fff-e486-35f0-a042fef859d9"></a>

* Specialized security software which helps collect monitor and analyse security events
* Collect data from legs and translates it into a easily usable format
* Monitor events in real time
* Send and generate alerts and reports
* Automate incident response
* Correlation of data from multiple sources
* Translation of event logs
* Easy to deploy
* Store and analyze large volumes of data
* Fast and efficient analysis
* Correlate logs and events to provide the most accurate overview of the system
* Allows for easy threat management
* Can be expensive
* Not certain they can properly adapt to working environment
* Not all providers provide full technical support

### Security Event management (SEM)

* Specialized in identification collection monitoring evaluation notifications and correlation in real time of events and alerts
* Used to identify suspicious behaviour
* Real time monitoring
* Obtain security events in devices and applications within the system.
* Correlation of events provide clear picture of the system
* Analyze logs
* Real time incident response
* Centralization of information
* Reduction of false positives
* Improvement in response time
* Hard to deploy
* High cost can prevent failures

\


### Security information and event management

* Aggregates and analyzes information
* Combination of SIM and SEM
* Configure devices to send logs to SIEM&#x20;
* Advanced threat detection
* Forensic and incident response
* Compliance reporting and auditing

### SIEM Platforms

* Graylog  open source and enterprise versions
* ARCSight
* QRADAR
* Logrhythm
* Splunk
