What is the difference between a SIEM (Security Information and Event Management) and a SOC (Security Operations Centre)?
Do they work together? And if independent when to use which?
At a high-level, just remember that:
A Security Information and Event Management (SIEM), is a tool that collects and normalises logs which are tested against a set of correlation rules that when triggered creates events for human analysts to analyse.
A Security Operations centre (SOC) is a centralised unit of security analysts (and related job roles) that deal with security issues, using a verity of tools. One of the main tools used by security analysts is a SIEM as it is the SIEM that will ‘surface’ security incidents to the human analyst.
Typically you will not have a SOC without a SIEM. But you may find IT teams that have a mature security element may have a SIEM (or something similar.) Although it is often the case (in my experience) that the SIEM capability will be outsources to a 3rd party or will be rolled up into a dedicated SOC.
You may also find that the SIEMS are used in Cyber Incident Response Teams (CIRTs) which are similar to SOCs, but may have expanded capability into other areas such as information sharing, intelligence and deeper incident repose.
If the SOC was a shop, the Security Analyst would be the retail assist working the tills and the SIEM would be the till.