SIEM
Security Information and Event Management
Aggregates and correlates logs for monitoring, alerting, and investigation.
A SIEM centralizes logs and events from across an environment, then normalizes and correlates them to detect suspicious patterns, raise alerts, and support investigation and compliance reporting. It gives analysts a single place to search and pivot during incident response. It is often paired with SOAR, which adds automated playbooks and response, and the exam stresses log aggregation, correlation rules, and tuning to manage false positives and alert fatigue.
Security Information and Event Management: aggregates logs and raises alerts. SIEM spots it, SOAR acts on it.
Looking SIEM up is step one. Getting tested on it is step two.
A free account opens all 4 Domain 1 objectives, 271 exam-style questions with a lesson and a lab on each, a placement check that skips what you already know, and a dated plan. No card.
Not affiliated with or endorsed by CompTIA.