AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/secplus-siem-correlates-logs

What does a SIEM mainly do with the log data it collects?

Start playing free

  1. Delete old entries automatically
  2. Analyze it to generate alerts
  3. Encrypt it for archival only

🔒 The answer is for AhaBulb members. Members see the answer, why it's right and the official sources for every card of Stuff Every Security Pro Should Know, plus timed practice exams.

The first 50 cards of every test are free to play.

Play the free cards See membership

Like this card?
Play the game

References

  1. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Checked 2026-10-10.
  2. NIST SP 800-92, Guide to Computer Security Log Management nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn syslog (RFC 5424), which severity code is the most severe?Security & PrivacyA user signs in from Nashville and, ten minutes later, from Tokyo. Which indicator of compromise is this?Security & PrivacyWhy does NIST advise using NTP to keep log sources' clocks consistent?

That's stuff everyone should know.