Security information and event management (SIEM) technology has existed since the late 1990s, but it has always been somewhat controversial in the security industry due to its initial promise of a “security single pane of glass” combined with slow adoption across smaller organizations. More recently, traditional SIEM has been joined by a broad use log management technology that focuses on collecting a wide variety of logs for a multitude of purposes, from security incident response to regulatory compliance, system management and application troubleshooting.

In this paper we will analyze the relationship between these two technologies - SIEM and log management - focusing not only on the technical differences and different uses for these technologies, but also on architecting their joint deployments.