What does a SIEM do in network security?

• A. It acts as a firewall between networks.
• B. It collects, correlates, and analyzes security events and logs to detect and respond to incidents.
• C. It provisions user accounts and access rights.
• D. It performs DNS resolution for internal hosts.

Answer: (B)

The function of a SIEM is to collect, correlate, and analyze security events and logs to detect and respond to incidents. It ingests data from multiple sources—firewalls, intrusion detection systems, servers, endpoints, applications, and cloud services—normalizes it, and stores it for analysis. By applying correlation rules and analytics, it links related events across devices to reveal complex or multi-step attacks that single logs might miss, then generates alerts and provides incident response workflows with rich context for investigation and forensics. It’s not a firewall that blocks traffic, not a tool for provisioning user accounts, and not a DNS resolver.