Which type of security system provides real-time reporting and long-term analysis of security events in an enterprise?

Which type of security system provides real-time reporting and long-term analysis of security events in an enterprise?

• A. Intrusion Detection System
• B. SIEM
• C. Firewall
• D. Endpoint protection

Answer: (B)

Centralized collection, correlation, and analysis of security events across an enterprise in real time and over the long term is what this type of system provides. A SIEM combines security information management (log collection and normalization) with security event management (real-time correlation and alerting). It gathers logs from across networks, systems, applications, and security devices, then analyzes them to detect patterns that indicate threats. Real-time reporting means you receive alerts as events occur, while long-term analysis lets you retain data for months or years to investigate incidents, identify trends, meet compliance, and perform forensics. This gives comprehensive visibility and proactive defense across the whole organization. Intrusion detection systems focus on spotting suspicious activity in network traffic, not on enterprise-wide, long-term analytics. Firewalls control traffic and log basic events but don’t provide centralized, historical analysis. Endpoint protection secures individual machines and may report to a console, but it doesn’t by itself deliver enterprise-wide, long-term security analytics.

Centralized collection, correlation, and analysis of security events across an enterprise in real time and over the long term is what this type of system provides. A SIEM combines security information management (log collection and normalization) with security event management (real-time correlation and alerting). It gathers logs from across networks, systems, applications, and security devices, then analyzes them to detect patterns that indicate threats. Real-time reporting means you receive alerts as events occur, while long-term analysis lets you retain data for months or years to investigate incidents, identify trends, meet compliance, and perform forensics. This gives comprehensive visibility and proactive defense across the whole organization. Intrusion detection systems focus on spotting suspicious activity in network traffic, not on enterprise-wide, long-term analytics. Firewalls control traffic and log basic events but don’t provide centralized, historical analysis. Endpoint protection secures individual machines and may report to a console, but it doesn’t by itself deliver enterprise-wide, long-term security analytics.