Which term is used for a centralized system that collects, analyzes, and correlates security events from multiple sources?

Which term is used for a centralized system that collects, analyzes, and correlates security events from multiple sources?

• A. NIDS/NIPS
• B. Network Tap
• C. SNMP Manager
• D. Security Information and Event Management (SIEM) Systems

Answer: (D)

Centralized collection, analysis, and correlation of security events from multiple sources is handled by a Security Information and Event Management system. A SIEM ingests logs and events from many places—firewalls, IDS/IPS, servers, endpoints, applications, and cloud services—then normalizes and analyzes that data. It uses correlation rules to tie together seemingly separate events into meaningful alerts, enabling real-time detection, dashboards, and reporting that support rapid investigation and response, as well as compliance requirements for log retention and auditing.

Other options don’t fit this role. A network intrusion detection and prevention system focuses on examining network traffic for suspicious patterns, not on aggregating and correlating security events from diverse sources. A network tap is simply a hardware device to mirror traffic for monitoring, not an analytics hub. An SNMP manager collects device health and performance data for network administration, not centralized security event correlation.

So the centralized, cross-source log collection and event correlation described aligns best with SIEM systems.