A SIEM performs data analytics on enterprise security data. It consumes a mass of alert and event data and distills it into a collection of curated and prioritized alerts for further investigation. SIEMs accomplish this transformation through these four steps: Data Collection: A SIEM’s effectiveness depends heavily on the data that it has access to. SIEMs will automatically ingest log and event data from across an organization’s IT infrastructure and store this data for analysis and historical lookbacks. Data Normalization: The data that SIEMs ingest and store comes from a variety of different places and is stored in multiple different formats. The SIEM system automatically normalizes the data that it receives and aggregates different data sources to provide more contextual information for different events. Data Analysis: SIEM systems process the data that they collect using a collection of predefined rules and data analytic techniques. This enables it to identify both known threats - such as malware matching a signature or a series of failed login events - and anomalies or trends that may indicate an attack. Alert Generation: Based on its analysis of the collected data, a SIEM can generate alerts to notify the security team about potential incidents and attacks. The SIEM can help security analysts to investigate a potential incident by providing responses to queries or additional analysis on request.