What is SIEM Software? A Practical Glossary for Singapore Buyers

SIEM is the security category that produces the most jargon — and the most overlap with adjacent categories such as SOAR, EDR, XDR, UEBA, and log management. Singapore buyers entering RFPs without a shared vocabulary tend to buy capabilities they already have, or miss capabilities they need. This glossary defines the core terms a Singapore SOC buyer should walk into a vendor meeting knowing, and maps them to PDPA, MAS TRM, and Cybersecurity Act realities. The goal is not to teach security engineering — it is to make the procurement conversation precise.

What this glossary covers

• SIEM: the core definition
• Log management vs SIEM
• SOAR and the place of automation
• EDR, NDR, and XDR — how they relate to SIEM
• UEBA and behavioural analytics
• MITRE ATT&CK and detection content
• Threat intelligence (TI) and TIPs
• Ingestion, retention, and tiered storage
• MSSP, MDR, and managed SOC models
• Common Singapore procurement terms (PDPA, MAS TRM, IM8, CSA)

SIEM: the core definition

Security information and event management (SIEM) is the security platform that ingests logs from across IT and business systems, normalises them, correlates events across sources, alerts on suspicious patterns, and stores them long enough for investigation and audit. SIEM started as log aggregation in the 2000s and has absorbed correlation, UEBA, threat intelligence, and increasingly SOAR. For Singapore buyers, the practical effect is one platform where MAS TRM monitoring obligations, PDPA breach investigation, and CSA Cybersecurity Act incident reporting all converge. SIEM is not endpoint protection — that's EDR. It is the analytical layer above multiple detection sources.

Log management vs SIEM

Log management is the prerequisite layer: collection, transport, parsing, and storage of log data. SIEM is what sits on top — adding correlation, alerting, dashboards, and investigation tooling. Many Singapore mid-market organisations start with log management (Splunk Core, ELK without Security) and graduate to SIEM (Splunk Enterprise Security, Elastic Security) when the security programme matures. Confusing the two during procurement is common; vendors selling SIEM features may quietly assume you have log management already, while log-management vendors may oversell their SIEM capabilities.

SOAR and the place of automation

Security orchestration, automation, and response (SOAR) is the layer that automates playbooks — when an alert fires, SOAR drives the steps that follow (enrich with threat intel, create a ticket, isolate an endpoint, notify analysts). The leading dedicated SOAR platforms in Singapore are Splunk SOAR (formerly Phantom), Palo Alto Cortex XSOAR, and IBM QRadar SOAR. Modern SIEMs increasingly bundle lightweight SOAR — Microsoft Sentinel's Logic Apps playbooks, LogRhythm's RespondX, Elastic's case management. For Singapore mid-market SOCs, bundled SOAR is usually enough; large enterprises with complex automation across many tools still prefer dedicated SOAR platforms.

EDR, NDR, and XDR — how they relate to SIEM

Endpoint detection and response (EDR) is the platform on endpoints — CrowdStrike Falcon, SentinelOne Singularity, Microsoft Defender for Endpoint. EDR catches what happens on laptops and servers. Network detection and response (NDR) is the equivalent on the network — Vectra, Darktrace, Cisco SecureX. NDR catches what flows between hosts. Extended detection and response (XDR) is the broader concept that pulls endpoint, network, identity, and cloud signals into one platform — Microsoft Defender XDR, Palo Alto Cortex XDR, SentinelOne Singularity XDR. SIEM is broader than XDR and looks at everything, including business systems; XDR tends to focus on security-relevant signals from security tools. Singapore SOCs increasingly run SIEM and XDR in tandem — XDR as the high-fidelity security data lake, SIEM as the broader compliance and audit layer.

UEBA and behavioural analytics

User and entity behaviour analytics (UEBA) is the analytical capability that builds baselines of normal behaviour for users, hosts, and services, then alerts on anomalies. UEBA is what surfaces a privileged user logging in from an unusual location, a service account suddenly accessing storage it never accessed before, or an employee downloading 100× more files than usual. Microsoft Sentinel, Splunk ES, Elastic Security, QRadar UBA, and LogRhythm all include UEBA. Standalone UEBA vendors (Exabeam, Securonix) often integrate into a SIEM. For Singapore buyers under MAS TRM, UEBA's coverage of privileged access patterns is increasingly an evaluation criterion.

MITRE ATT&CK and detection content

MITRE ATT&CK is the public framework that catalogues real-world attacker behaviour into tactics (the why — initial access, lateral movement, exfiltration) and techniques (the how — phishing, valid accounts, credential dumping). SIEM detection content is increasingly described in ATT&CK terms — Microsoft Sentinel content is tagged by tactic and technique, Splunk Security Essentials maps detections to ATT&CK, MITRE publishes ATT&CK-aligned detection rules openly. For Singapore SOCs, mapping your detection coverage to ATT&CK is the most useful way to express maturity in management and audit reviews. Coverage gaps in specific ATT&CK techniques drive the next quarter's content engineering priorities.

Threat intelligence (TI) and TIPs

Threat intelligence is the curated information about threats — indicators of compromise (IPs, domains, hashes), tactics seen in the wild, and threat actor profiles. Threat intelligence platforms (TIPs) such as Anomali, MISP, ThreatConnect, and Recorded Future centralise this feed and forward it to SIEM for correlation. For Singapore buyers, the relevant feeds typically combine global commercial intel (Mandiant, Recorded Future, CrowdStrike Falcon Intelligence) with regional and CSA-issued advisories. SIEM platforms that integrate threat intel natively (Sentinel via TAXII feeds, Splunk via the Threat Intelligence Framework, QRadar X-Force) reduce the need for a separate TIP at smaller scales.

Ingestion, retention, and tiered storage

Ingestion is the rate at which logs enter the SIEM, measured in GB per day. Retention is how long the data stays searchable. Hot retention is searchable in seconds for analyst workflows; warm retention is searchable in minutes for investigation; cold or archive is exported to lower-cost storage for compliance. Singapore typically requires 12 months hot + 24 months warm for MAS TRM and Cybersecurity Act CII compliance; PDPA-led buyers settle around 6-12 months hot. Tiered storage models (Microsoft Sentinel basic logs and archived logs, Elastic frozen tier, Splunk SmartStore) reduce cost by 60-90% at the expense of search latency. Confirm during evaluation how each platform handles audit-friendly export from each tier.

MSSP, MDR, and managed SOC models

Managed security service provider (MSSP) is the traditional model — the partner monitors your SIEM, triages alerts, and escalates to your team. Managed detection and response (MDR) is the more outcome-focused evolution — the partner not only monitors but takes action (isolate endpoint, block account, contain incident). In Singapore, providers such as Ensign InfoSecurity, ST Engineering Cyber, Quann (Quann SOC), and global MDR vendors (CrowdStrike, SentinelOne Vigilance, Sophos MDR) operate in this space. The line between MSSP and MDR has blurred; what matters is the specific scope of authority you grant the partner to take action, the response SLAs, and whether they staff a SOC onshore in Singapore.

Common Singapore procurement terms (PDPA, MAS TRM, IM8, CSA)

RFPs in Singapore surface a recurring vocabulary. PDPA — the Personal Data Protection Act — drives MFA, audit log, and breach assessment requirements. MAS TRM is the Monetary Authority of Singapore's Technology Risk Management guidelines, covering monitoring of privileged access, real-time alerting, and retention. IM8 is the public sector ICT&SS instruction manual, with explicit identity and audit clauses. CSA is the Cyber Security Agency of Singapore — the body that designates CII operators under the Cybersecurity Act and issues advisories. Vendors should be able to map their SIEM capabilities to each of these frameworks on request. Vendors that can produce written mapping tables tend to integrate cleanly with Singapore audit cycles; those that cannot typically surface friction at DPO review.

Log normalisation and parsing

Before a SIEM can correlate events, it must normalise them — converting raw logs from firewalls, endpoints, identity providers, and cloud platforms into a common schema. Parsing extracts the meaningful fields (source IP, user, action, outcome) from each log format. For Singapore buyers, parsing quality is the unglamorous factor that decides whether detections work. A SIEM with strong out-of-box parsers for your specific log sources saves weeks of content engineering; a SIEM that requires custom parsers for common Singapore systems quietly extends the implementation. Microsoft Sentinel, Splunk, and Elastic each ship large parser libraries; QRadar uses DSMs (Device Support Modules); confirm coverage for your actual estate during the proof of concept rather than trusting the vendor's source-count claim.

False positives and detection tuning

A false positive is an alert that fires on benign activity. The false-positive rate is the single biggest determinant of whether a Singapore SOC trusts its SIEM. Out-of-box detection rules are written for a generic environment; in your environment they will over-fire until tuned. Tuning means adjusting thresholds, adding allowlists for known-good behaviour, and suppressing noisy rules — work that never ends because the environment keeps changing. Singapore SOCs that budget for continuous detection engineering keep their SIEM useful; those that treat tuning as a one-time setup task end up with thousands of ignored alerts. Ask vendors how their platform measures and reduces false positives, and whether tuning is self-service or requires professional services.

Explore the products

Bridging the glossary to procurement

Two practical bridges help Singapore procurement teams move from glossary to deal. First: ask vendors to provide an ATT&CK coverage matrix for your environment shape, showing which techniques are covered out-of-box and which require content engineering. Second: ask for a written PDPA / MAS TRM / IM8 / CSA mapping table covering retention, monitoring, audit export, and Singapore data residency. Vendors that produce these on request tend to integrate smoothly with Singapore audit cycles; those that cannot are usually friction generators later.