What is security information management (SIM)?
Security information management (SIM) is the practice of collecting, monitoring and analyzing security-related data from computer logs. A security information management system (SIMS) automates that practice. Security information management is sometimes called security event management (SEM) or security information and event management (SIEM). Security information includes log data generated from numerous sources, including antivirus software, intrusion-detection systems (IDS), intrusion-prevention systems (IPS), file systems, firewalls, routers, servers and switches. Security information management systems may: • Monitor events in real time. • Display a real-time view of activity. • Translate event data from various sources into a common format, typically XML. • Aggregate data. • Correlate data from multiple sources. • Cross-correlate to help administrators discern between real threats and false positives. • Provide automated incidence response. • Send alerts and generate reports. Com
