What Is SIEM? Security Information and Event Management for SMEs

For the wider picture, this sits inside AMVIA's managed cybersecurity services for UK SMEs — SIEM is one capability within a monitored security stack, not a product you buy in isolation.

What is a SIEM and how does it work?

A SIEM combines two jobs: collecting security logs from every system, and analysing those logs in real time to detect threats. It ingests data from endpoints, Active Directory or Entra ID, firewalls, cloud audit logs, and email security, then applies correlation rules to surface attack patterns a single tool would miss.

The detection power comes from correlation — spotting patterns across sources that are invisible in isolation. A single failed login is not worth investigating. But failed logins from multiple locations, then a successful login from an unfamiliar IP, then a new inbox forwarding rule to an external address, together signal a compromised account being actively exploited. SIEM stitches these events into one actionable alert.

According to the DSIT Cyber Security Breaches Survey 2025, 43% of UK businesses experienced a cybersecurity breach or attack in the past twelve months. Many of those attacks span email, identity, endpoint, and cloud — exactly the kind of multi-stage activity correlation is built to catch.

How does a SIEM detect threats, step by step?

A SIEM works through four connected stages: collect, normalise, correlate, alert. Log connectors gather event data from across the estate; the platform standardises it; a correlation engine applies detection rules; and analysts investigate the alerts that result. The technology produces signals — people turn signals into decisions.

• Collect — agents and connectors pull Windows Security Event logs, firewall logs, Microsoft 365 audit logs, Entra ID sign-in logs, EDR alerts, DNS queries, and email gateway logs. Even a 50-user business can generate millions of events per day.
• Normalise — disparate formats are translated into a common schema so one rule works across every source.
• Correlate — rules range from simple thresholds (five failed logins in a minute) to multi-stage chains (failed VPN login, then cloud login from another country, then bulk download). User and Entity Behaviour Analytics (UEBA) baselines normal activity and flags deviations.
• Alert — when a rule fires, the SIEM bundles the evidence, users, devices, and timeline into one alert for an analyst to triage.

SIEM vs SOC: what's the difference?

A SIEM is technology; a SOC is people. The SIEM collects logs, applies rules, and raises alerts. A Security Operations Centre (SOC) is the team of analysts who monitor that platform, investigate the alerts, and respond to confirmed threats. The SIEM generates the noise; the SOC supplies the judgement.

This matters because a SIEM with no SOC is a burglar alarm nobody is listening to. The alerts still fire, but without trained analysts they pile up unactioned and real threats get lost. Per the DSIT Cyber Security Breaches Survey 2025, only 14% of UK businesses have a formal incident response plan — detection without a response capability is a false sense of security, not protection. AMVIA's managed SOC service supplies that analyst layer 24/7 without you hiring specialist staff.

Why is running a SIEM hard for SMEs?

Traditional SIEM platforms — Microsoft Sentinel, Splunk, IBM QRadar, Elastic — are powerful but demand expertise and budget most SMEs do not have in-house. The result is usually a half-tuned platform raising alerts nobody investigates, which delivers no security value at all.

For most UK SMEs without dedicated security staff, operating a standalone SIEM in-house is not practical. A platform that generates hundreds of unread daily alerts just creates an audit trail proving you were warned about threats you never acted on.

When does an SME genuinely need SIEM capability?

Some SMEs do need what a SIEM provides — usually driven by compliance, insurance, or contract obligations rather than choice. The trigger is rarely "we want a SIEM"; it is "a regulator, insurer, or client requires evidence of active monitoring and log retention".

• Regulatory compliance — financial services, healthcare, and legal sectors often require centralised log retention and audit trails for set periods. SIEM provides that storage and search.
• Cyber insurance — insurers increasingly require evidence of security monitoring as a condition of cover.
• Supply chain due diligence — larger clients and government contracts may demand proof of active monitoring.
• Post-incident investigation — historical log data is essential to scope a breach and trace how an attacker got in.
• Multi-source attack detection — attacks crossing email, identity, endpoint, and cloud can only be caught by correlating across sources.

The average cost of a data breach for UK organisations was £3.58 million (IBM Cost of a Data Breach Report, 2024). For regulated businesses handling sensitive data, the cost of SIEM capability — run directly or consumed as a service — is modest against that exposure.

How does SIEM work with Microsoft 365?

If you run Microsoft 365, you already have meaningful cross-source correlation built in. Microsoft 365 Defender correlates signals across Defender for Business (endpoint), Defender for Office 365 (email), and Entra ID Protection (identity) to detect multi-stage attacks inside the Microsoft ecosystem — a solid foundation before any dedicated SIEM.

Microsoft Sentinel, Microsoft's cloud-native SIEM, extends this by ingesting Defender alerts alongside non-Microsoft sources — third-party firewalls, Linux servers, and SaaS apps — and adds custom detection rules, UEBA, automated response, and long-term retention. AMVIA deploys and manages Sentinel for clients needing full log correlation and retention. For most SME clients, AMVIA pairs M365 Defender's built-in correlation with Microsoft Defender for Business, monitored by our in-house 24/7 SOC, to deliver SIEM-grade outcomes without you running a full Sentinel deployment.

MDR vs SIEM: what do SMEs actually need?

For most UK SMEs the answer is MDR, not a standalone SIEM. A SIEM is a technology that produces alerts; managed detection and response (MDR) is a service that includes the analysts who investigate and act on those alerts, using SIEM-class detection as the underlying engine.

The SME bottleneck is rarely the log platform — it is the expertise to tune rules, filter false positives, investigate alerts, and respond to confirmed threats. AMVIA's managed detection and response service supplies exactly that: cross-source detection, expert investigation of every alert, and active containment when an attack is live. You get the security outcomes SIEM enables, delivered as a service rather than a platform you must staff. Our 24/7 security monitoring means alerts are seen and acted on around the clock, not collected and forgotten.

How much does SIEM cost for an SME?

SIEM pricing is driven by data volume. Microsoft Sentinel and Splunk both charge per gigabyte ingested, so costs can run from a few hundred to several thousand pounds a month depending on log sources — before you add the analyst time to operate the platform and investigate alerts.

Managed MDR services bundle technology and analyst cost into a predictable per-user or per-endpoint monthly fee. For most SMEs that is cheaper than building in-house, where a SIEM licence plus analyst salaries plus ongoing training significantly exceeds the cost of a managed service delivering equivalent or better detection. AMVIA prices monitoring per user or endpoint so the bill stays predictable as you grow — book a free security audit for a figure scoped to your environment.

Security monitoring readiness checklist

Use this to judge detection maturity. The real question is not "do we have a SIEM?" but "are suspicious events detected, investigated, and acted upon?"

• Security logs collected from all key sources — endpoints, identity, email, network
• Log retention meets compliance requirements — typically 12 months minimum
• Alerts reviewed and investigated — not just collected
• Cross-source correlation active — single-source alerts miss multi-stage attacks
• Incident escalation procedure defined — who receives alerts and what they do
• Microsoft 365 audit logging enabled — required for Entra ID and Exchange Online investigation

The NCSC's logging and monitoring guidance is a useful reference for what good detection coverage looks like.