Last updated: 7 November 2026
SIEM (security information and event management) is a system that collects log data from your devices, Microsoft 365, firewalls and servers, joins it together in one place, and raises an alert when the pattern looks like an attack. It gives a business the visibility to spot a breach early and the evidence to investigate and report it afterwards.
What does a SIEM actually do?
Collects logs
Pulls sign-in, device, email, firewall and server logs into one searchable store, so nothing sits on a single machine where an attacker could wipe it.
Correlates events
Joins small clues together. One failed login is noise. Fifty failures, then a success from another country, then a mailbox rule is an incident.
Raises alerts
Applies detection rules and threat intelligence, then ranks alerts so people look at the dangerous ones first.
Keeps evidence
Retains logs so you can answer who, what and when after an incident. The NCSC suggests keeping the logs that answer these questions for at least six months.
Why does a small business need one?
Prevention tools block most attacks, but some get through, and without logs you may not know for weeks. The 2025 Verizon report found stolen credentials were the most common way in (22% of breaches), followed by exploited vulnerabilities (20%) and phishing (16%). All three show up in logs long before the damage is done, if somebody is watching.
SIEM, EDR and SOC: how they fit together
| Tool | What it watches | Main job |
|---|---|---|
| SIEM | Logs from everything: devices, cloud, network, identity | Collect, correlate, alert and keep evidence |
| EDR | Behaviour on each laptop, desktop and server | Detect and contain threats on the device |
| ITDR | Sign-ins and identity changes in Microsoft 365 and Entra | Stop account takeover |
| SOC | People: analysts who review alerts | Investigate and respond, ideally 24/7 |
A SIEM is only as good as the people reading it. Raw alerts without analysts become noise, which is why small businesses usually get SIEM as a managed service with a security operations centre (SOC) behind it, rather than running one in-house.
What should I ask a provider about SIEM?
- Which log sources are collected (Microsoft 365, endpoints, firewall, servers)?
- How long are logs kept, and can you export them for an insurer or regulator?
- Who investigates alerts, and when (24/7 or office hours only)?
- What happens when something serious is found: who contacts you, and how fast?
- Is it priced per user or per device, with no surprise data charges?
How ABCOM helps
ABCOM, an NCSC Assured Service Provider, includes monitoring and detection in managed IT support and our cyber security services, and can add SIEM-style log collection and analyst-led monitoring where a customer, insurer or contract calls for it. We will tell you plainly whether you need it, or whether endpoint and identity protection already cover your risk.
Quick answers
Do small businesses need a SIEM?
Not always as a separate product. Many small businesses are well covered by managed endpoint detection and identity protection. A SIEM becomes valuable when you must retain logs for compliance, hold sensitive data, work with regulated customers, or need a single record of activity across cloud and on-premises systems.
Is Microsoft Sentinel a SIEM?
Yes. Microsoft Sentinel is Microsoft’s cloud-native SIEM. Other SIEM products exist, and managed security providers often run their own, so the right choice depends on your Microsoft licences, log volume and who will monitor it.
What is the difference between SIEM and antivirus?
Antivirus blocks known malware on one device. A SIEM looks across all your systems and spots suspicious patterns, such as an unusual sign-in followed by a forwarding rule, that no single device can see.
Not sure whether you need SIEM, EDR or both? Book a free 20-minute call and we will map it to your risk, not a sales sheet.
Related answers and guides
- What is endpoint protection?
- What is EDR?
- What is ITDR?
- EDR, MDR, SIEM, SOC and ITDR explained
- What is an incident response plan?
- Cyber security services
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about cyber security services. Free, friendly and no obligation.