In a properly configured environment, SIEM allows for the construction of a true audit trail.
This traceability can be useful for:
- the investigations
- the audits
- compliance
- post-incident analyses
- governance
- internal controls.
It allows, in particular, switching between:
“We think that…”
has :
“The newspapers show that…”
This distinction is fundamental in an investigation.