Define SIEM and its core functions in a SOC environment.

• A. A system that collects logs, correlates events, analyzes data, and produces alerts, dashboards, and case management for incident handling
• B. A firewall appliance
• C. A tool for vulnerability scanning
• D. A backup software for disaster recovery

Answer: (B)

SIEM stands for Security Information and Event Management, and in a SOC it acts as the central brain for security data. It collects logs from across servers, endpoints, network devices, and applications, normalizes that data so it can be compared, and then uses correlation rules and analytics to spot patterns that might indicate an incident. When something suspicious is detected, it generates alerts and provides dashboards that give analysts visibility into overall security posture. It also supports case management, so investigators can track investigations, store evidence, and collaborate on responses. Plus, SIEM keeps data for forensics and compliance, with powerful search and reporting capabilities to surface the details you need later.

The other options describe different tools with distinct roles: a firewall appliance controls traffic and enforces policies; a vulnerability scanner looks for weaknesses in systems; backup software protects data and supports recovery after incidents.