What is the role of a SIEM in security operations?

• A. Mints digital certificates.
• B. Collects, correlates, and analyzes logs/events; generates alerts, provides dashboards, and supports investigations.
• C. Monitors physical access.
• D. Encrypts data in transit.

Answer: (B)

A SIEM’s role in security operations is to bring together logs and events from across the environment, analyze them, and turn that data into actionable security insight. It collects data from devices, applications, and services, normalizes it so everything can be compared, and uses correlation rules or analytics to identify patterns that suggest a security incident. When something noteworthy is found, it generates alerts, offers dashboards for visibility, and provides investigators with context and timelines to support incident response and forensic analysis. This centralized, analytic approach helps security teams detect threats more quickly and respond more effectively.

Other options describe different security functions. Issuing digital certificates is handled by a certificate authority as part of PKI, not by a SIEM. Monitoring physical access falls under physical security or access-control systems. Encrypting data in transit is the domain of encryption protocols and key management. These are related to security, but they serve distinct roles separate from the SIEM’s job of collecting, correlating, and analyzing logs to drive alerts and investigations.