What is SIEM and what is its role in Annex F monitoring?

• A. System Integration for Enterprise Management coordinates vendor software.
• B. Security Information and Event Management collects, correlates, and analyzes security events for real-time and historical insight.
• C. Security Incident Emergency Management handles disaster response.
• D. Security Information and Event Manual provides manuals for event handling.

Answer: (B)

Security Information and Event Management, or SIEM, is all about centralizing security visibility. It collects logs and security events from across an organization’s systems, normalizes and correlates those events, and analyzes them to produce alerts and reports. This lets security teams detect real-time threats and also investigate past incidents with historical data.

In Annex F monitoring, SIEM provides the essential capability to monitor security activity continuously across the environment. It gathers data from firewalls, servers, workstations, applications, and other devices, runs correlation rules to spot suspicious patterns, and delivers actionable alerts, dashboards, and audit trails. This supports rapid incident detection, investigation, and compliance reporting.

The other descriptions describe things like coordinating vendor software, handling disaster response, or providing manuals, which do not capture the function of collecting, correlating, and analyzing security events for real-time and historical insight.