Security information and event management (SIEM)
Also called: SIEM
Course: AP® Cybersecurity Shows up in: Unit 2: Securing SpacesUnit 3: Securing Networks
A system that collects and analyzes data from many sources to detect attack patterns and alert analysts, who resolve or escalate the alert.
Appears in the course and exam description (CED): 3.5.A.42.1.F.3
Why it matters in Unit 3
It connects clues that no single log shows.
Example
Failed logins plus a new outbound connection from the same laptop trigger one alert.
Learn it properly, with a checkpoint 3.5 Detecting Network Attacks