A team collects logs from many cloud services into a central platform and wants a capability that not only stores the events but also correlates them in near real time to raise alerts on suspicious patterns. Which statement most accurately distinguishes a SIEM from a basic log management system?
- AA SIEM adds correlation, alerting, and analysis across aggregated events, whereas log management chiefly collects, stores, and retains them Correct
- BA SIEM only archives raw events for compliance retention, whereas log management performs the real-time correlation and alerting
- CA SIEM replaces the need to generate logs at each source because it produces its own event records independently
- DA SIEM and log management are interchangeable terms, differing only in the vendor branding applied to the same tool
Why A is correct: This captures the real distinction: log management centralises collection, storage, and retention, while a SIEM layers cross-source correlation, analytics, and near real-time alerting on top of that aggregated data.
Why B is wrong: This reverses the two roles; archiving for retention is the log management function, and correlation with alerting is what the SIEM adds, so the mapping is backwards.
Why C is wrong: A SIEM depends on events forwarded from sources; it does not manufacture authoritative records on their behalf, so treating it as a substitute for source logging is incorrect.
Why D is wrong: The terms are not synonyms; conflating them ignores the analytical correlation and alerting layer that defines a SIEM beyond simple collection and storage.