Main components of a SIEM Tool

SIEM also known as Security Information and event management tools are kind of log aggregation tools which helps you to view raw logs in a readable format. These raw logs can have any source like a firewall, a mobile phone or even a smart fridge. The SIEM tool helps presenting these logs in a format such that they are easy to query on and we can make sense out of these logs. To know how an SIEM tool works, it is necessary to understand the main components of a SIEM tool.

In this post we will be going through the main components of a SIEM tool:

Forwarding agent

Forwading agent is an application which runs in the background and collects logs from various sources defined in configuration. The forwarding agent continuously forwards logs generated on the machine to the Collection/Indexing server.

Collection/Indexing Server

The Indexing server aggregates all the logs that are forwarded from Forwarding Agent (from various machines, servers, etc.) and parses them so they become readable in a key value pair, hence they can be easily queried by search application.

Search Application

This is a web application which provides functionality to query logs on the indexing server. This is through this application that we can create rules that can trigger when a pattern matches and helps us in generating alerts.