What is a SIEM and how does it work?

SIEM is the central nervous system of security operations.

Explain SIEM technology and its role in security operations.

SIEM (Security Information and Event Management) collects, normalizes, and correlates logs from across the infrastructure. Functions: log aggregation, real-time correlation, alerting, dashboards, compliance reporting, threat intelligence integration. Major platforms: Splunk, Microsoft Sentinel, IBM QRadar, Elastic SIEM, Wazuh. SIEM rules detect known attack patterns while ML detects anomalies.

SIEM knowledge is essential for SOC roles. Showing experience with specific platforms, rule writing, and alert tuning demonstrates operational capability.