What is a SIEM (Security Information and Event Management) system, and what are the two core functions that distinguish it from a simple log aggregation tool?

• A.SIEM collects logs from diverse sources (firewalls, IDS/IPS, endpoints, servers, DNS, proxy) and provides: (1) Security Event Correlation - applying rule-based logic or machine learning to correlate multiple events across different systems into actionable alerts (e.g., failed login + privilege escalation + lateral movement = compromised account); (2) Normalized Log Storage and Search - enables forensic investigation of historical events across all sources from a single interface.
• B.SIEM is a firewall with built-in logging; it only collects logs from network devices.
• C.SIEM replaces both IDS and IPS; it detects and blocks threats in real time on network traffic.
• D.SIEM is purely a compliance tool that formats logs for regulatory reports; it does not perform security analysis.