Classic SIEM architecture includes a database, correlation engine, and UI, with the engine including various agents, scanners, and detectors.