A SIEM is centralized logging software that collects logs from many sources, then filters, aggregates, normalizes and correlates them so analysts can spot significant events. Sending copies of logs to central servers also protects them, because an attacker who alters a host's own logs usually cannot reach the central copies.
How logs reach the SIEM
NIST SP 800-92 describes three tiers: log generators, log servers that receive copies of the logs, and consoles for monitoring and reports. Servers that receive logs from many generators are sometimes called collectors or aggregators.
A SIEM collects logs in one of two ways. Agentless: the server pulls logs by authenticating to each host, or hosts push logs to it. Agent-based: an agent on each host filters, aggregates and normalizes the logs before sending them. The agentless method skips filtering at the host, so much more data crosses the network.
What the SIEM does with the data
Event filtering suppresses entries unlikely to matter, such as routine informational entries, from analysis or reporting without altering the original log files. Event aggregation merges similar entries into one entry with a count.
Normalization converts each field to one consistent format, for example one date and time format. Correlation finds relationships between entries; the most common form is rule-based correlation, which matches entries on values such as timestamps, IP addresses and event types, and can raise an alert.
Timestamps and evidence
Each host stamps entries from its own clock. If a database server runs two minutes behind the firewall, the timeline is wrong. SP 800-92 says to use time synchronization such as Network Time Protocol (NTP) servers whenever possible.
During an incident, attackers may alter or destroy a system's own logs, but they usually have no access to the central infrastructure logs. Responders can compare the two copies to see what was changed or removed.
Where the exam catches people
Believing normalization fixes clock drift: normalization reformats timestamps, while NTP keeps the source clocks in sync so the times are correct in the first place.
Believing filtering deletes log data: event filtering removes entries from analysis or reporting and does not alter the original log files.
Believing "aggregation" always means one thing: collecting copies on central servers is log aggregation, while NIST's event aggregation merges similar entries into one counted entry.
Believing agentless collection is lighter on the network: without host-level filtering, agentless collection usually sends much more data.