What is a primary function of SIEM in security operations?

• A. SIEM replaces firewalls as a protective barrier.
• B. SIEM aggregates logs, correlates events, and provides dashboards and alerts for incident response.
• C. SIEM is used for storing email archives.
• D. SIEM automatically patches vulnerabilities.

Answer: (B)

SIEM’s function is to collect logs and security data from multiple sources, normalize and correlate those events, and deliver dashboards and alerts that support incident detection and response. By bringing disparate logs into one view and applying correlation rules, it helps security analysts see trends, spot suspicious activity, and build a timeline of an incident for quick investigation and containment. It’s not meant to replace a firewall, store email archives, or automatically patch vulnerabilities; its value comes from turning raw data into actionable visibility and workflow for security operations.