> Source: https://complior.se/en/siem/

Service details 

# Log analysis that makes events understandable 

See connections between your security events. Collect relevant logs and decide how anomalies will be investigated and followed up. 

## From multiple sources to a connected picture 

Complior's SIEM service collects and analyses log data from selected networks, servers and applications. Correlating events can help identify patterns that are difficult to see in a single log. 

The sources and environments to be connected need to be specified as part of the service. Collecting logs from a system does not mean that Complior takes over operation of the entire system. 

## Alerts need a working process 

Rules and analysis can flag anomalies for further action. Decide which events take priority, who receives alerts and what the recipient is authorised to do. Detection and actual remediation are different parts of the same process. 

Review the relevance of alerts and adjust as systems change. No analysis can guarantee that every attack will be detected or that every alert represents an actual intrusion. 

## Traceability and reporting 

Log analysis can provide evidence for incident investigations, access reviews and security assessments. The reports and controls needed depend on the environment and its applicable requirements. 

Complior's service description specifies storage and analysis in Sweden. Define which log streams are covered, who has access and how long the data needs to be retained. Logs may contain personal data and sensitive technical details. 

## What we need to agree on 

- Log sources, events and technical connections. 

- Alert rules, priorities and staffed hours. 

- Responsibility for investigation, escalation and action. 

- Reporting, retention periods and access to the evidence. 

Take the next step. 

[Discuss logs and follow-up →](https://complior.se/en/contact/) [All solutions →](https://complior.se/en/solutions/)