Guide
What is SIEM? A plain-English guide for Australian organisations
What a SIEM does, how it works, what Australia's cyber security authority recommends, and how to tell whether you need one.
Last reviewed 18 October 2026.
SIEM in one paragraph
SIEM stands for security information and event management. A SIEM is a platform that collects logs and security events from across an organisation's systems (endpoints, servers, cloud services, identity, network devices and applications), brings them together in one place, correlates them to spot activity that looks like an attack, raises alerts, and keeps the records needed to investigate incidents and report on them.
How a SIEM works
- Collection. Systems are configured to send their logs to the SIEM: sign-ins, endpoint alerts, firewall and network events, cloud activity, application logs.
- Normalisation. Logs arrive in many formats; the SIEM parses them into a common structure so they can be searched and compared.
- Correlation and detection. Detection rules and analytics look across sources for patterns, such as a suspicious sign-in followed by unusual access to sensitive data.
- Alerting and investigation. When a rule fires, analysts get an alert with the related events, and can search back through history to see what happened.
- Retention and reporting. Logs are kept, protected, for investigations, audits and compliance reporting.
What Australia's cyber security authority recommends
The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) has published guidance on event logging and SIEM, developed with international partner agencies:
- Best practices for event logging and threat detection sets out key actions: maintain an enterprise-approved event logging policy; centralise, secure and retain event logs; prioritise high-value logs from critical systems, cloud services and network infrastructure; and implement threat detection and behavioural analytics.
- Priority logs for SIEM ingestion covers which logs to collect first. It advises tailoring collection to your environment and risk profile, and building up data sources gradually rather than adding them all at once.
- Implementing SIEM and SOAR platforms is the companion guidance for the teams that set these platforms up, with a separate version for executives.
SIEM, SOAR, XDR, SOC and MDR
These terms overlap, and vendors use them loosely. In short:
- SIEM collects and correlates logs from everywhere, and keeps them.
- SOAR (security orchestration, automation and response) automates the response to alerts with playbooks. Some SOAR platforms include SIEM functions, and some SIEMs include automation.
- XDR (extended detection and response) brings detection and response together across endpoint, identity, cloud and network, usually from one vendor's sensors.
- A SOC (security operations centre) is the team and processes that use these tools to watch for threats and respond.
- MDR (managed detection and response) is that capability delivered as a service.
For a side-by-side comparison, see EDR vs XDR vs MDR vs SIEM.
Do you need a SIEM?
A SIEM is worth it when you need to see across many systems at once, keep a searchable record for investigations or compliance, and have people (in house or a provider) to act on what it finds. Questions to ask first:
- Who will respond to the alerts, and when?
- Which log sources matter most for your risks, and are they available?
- How much data will you send, and what will ingestion and storage cost?
- How long do you need to keep logs, and who needs access to them?
- Would XDR or a managed service cover what you need with less effort?
Why SIEM projects disappoint, and how to avoid it
- Missing data. The logs that would have shown the attack were never connected. Start from the priority log sources for your environment.
- Alert noise. Default rules fire constantly and real alerts get lost. Rules need tuning to your organisation.
- Nobody watching. A SIEM detects; people respond. Plan who handles alerts before go-live.
- Runaway cost. Ingesting everything is expensive. Decide what each source is for.
How TOM SHAW helps
TOM SHAW delivers SIEM implementation and managed SIEM for organisations across Australia: choosing the platform, onboarding the log sources that matter, tuning detections, and running the platform for you. We work with SIEM and security analytics platforms from our partners, including SentinelOne and OpenText, and with SOC, MDR and XDR when you need people to respond as well.
SIEM: common questions
What does SIEM stand for?
Security information and event management. The name combines security information management (collecting and keeping logs) with security event management (monitoring and alerting on events).
What is a SIEM used for?
Detecting attacks by correlating logs from across your systems, investigating incidents with a searchable history, and keeping records for compliance and reporting.
What is the difference between a SIEM and a SOC?
A SIEM is a technology platform. A SOC is the team and processes that monitor for threats and respond, often using a SIEM as one of its main tools.
Does XDR replace a SIEM?
Not necessarily. XDR covers detection and response across the sources it integrates with, while a SIEM collects logs from almost any source and retains them for investigation and compliance. Many organisations use both, and some platforms combine them.
Where can I find Australian guidance on SIEM?
ASD's ACSC publishes guidance on cyber.gov.au, including Best practices for event logging and threat detection, Priority logs for SIEM ingestion, and Implementing SIEM and SOAR platforms.
Can TOM SHAW implement or manage a SIEM for us?
Yes. TOM SHAW implements SIEM platforms and offers managed SIEM for organisations across Australia.