What is the difference between a SIEM (Security Information and Event Management) and a SOC (Security Operations Centre)?
Do they work together? And if independent when to use which?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
At a high-level, just remember that:
A Security Information and Event Management (SIEM), is a tool that collects and normalises logs which are tested against a set of correlation rules that when triggered creates events for human analysts to analyse.
A Security Operations centre (SOC) is a centralised unit of security analysts (and related job roles) that deal with security issues, using a verity of tools. One of the main tools used by security analysts is a SIEM as it is the SIEM that will ‘surface’ security incidents to the human analyst.
Typically you will not have a SOC without a SIEM. But you may find IT teams that have a mature security element may have a SIEM (or something similar.) Although it is often the case (in my experience) that the SIEM capability will be outsources to a 3rd party or will be rolled up into a dedicated SOC.
You may also find that the SIEMS are used in Cyber Incident Response Teams (CIRTs) which are similar to SOCs, but may have expanded capability into other areas such as information sharing, intelligence and deeper incident repose.
If the SOC was a shop, the Security Analyst would be the retail assist working the tills and the SIEM would be the till.
NMS is a management tool of NOC same as SIEM solution is the Management tool of a SOC. SIEM provides an additional layer of security to a SOC which helps organizations enable advanced threat detection and incident response capabilities.
While A SOC comprises of all entities which are used for security monitoring within corporate IT environment like people, procedure, security software, security devices like firewalls, IDS/IPS, proxy servers, etc.