Security event management (SEM), and the related SIM and SIEM, are computer security disciplines that use data inspection tools to centralize the storage and interpretation of logs or events generated by other software running on a network. Overview The acronyms SEM, SIM and SIEM have sometimes been used interchangeably, but generally refer to the different primary focus of products: Log management: Focus on simple collection and storage of log messages and audit trails Security information management (SIM): Long-term storage as well as analysis and reporting of log data. Security event manager (SEM): Real-time monitoring, correlation of events, notifications and console views. Security information and event management (SIEM): Combines SIM and SEM and provides real-time analysis of security alerts generated by network hardware and applications. Event logs Many systems and applications which run on a computer network generate events which are kept in event logs. These logs are essentially lists of activities that occurred, with records of new events being appended to the end of the logs as they occur. Protocols, such as syslog and SNMP, can be used to transport these events, as they occur, to logging software that is not on the same host on which the events are generated. The better SEMs provide a flexible array of supported communication protocols to allow for the broadest range of event collection. It is beneficial to send all events to a centralized SEM system for the following reasons: Access to all logs can be provided through a consistent central interface. The SEM can provide secure, forensically sound storage and archival of event logs (this is also a classic log management function). Powerful reporting tools can be run on the SEM to mine the logs for useful information. Events can be parsed as they hit the SEM for significance, and alerts and notifications can be immediately sent out to interested parties as warranted. Related events which occur on multiple systems can be detected which would be very difficult to detect if each system had a separate log. Events which are sent from a system to a SEM remain on the SEM even if the sending system fails or the logs on it are accidentally or intentionally erased. Security analysis Although centralised logging has existed for long time, SEMs are a relatively new idea, pioneered in 1999 by a small company called E-Security, and are still evolving rapidly. The key feature of a