> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem.md).
# SIEM
The Enginsight SIEM (Security Information and Event Management) collects comprehensive security information from various internal and external log sources, analyzes incoming log data, and makes it available in a central [data lake](/docs/manual/english/platform-usage/siem/data-lake.md) for further processing.
For example, [workflows](/docs/manual/english/platform-usage/siem/workflows.md) can be used to detect critical event patterns. These patterns can then be used in [playbooks](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks/add-playbook.md#tile-entry-point) to define and execute automated response processes.
***
## Requirements
* The Enginsight SIEM is a separately licensed add-on for the Enginsight platform. A valid Enginsight on-premises license is required to operate it.
* The SIEM must be [installed and configured on separate servers](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-siem.md).
***
## Navigation
:computer-mouse: Click the **SIEM** icon  in the sidebar to open the **SIEM** menu.
{% hint style="info" %}
**Please note:** The order of the main menu items can be customized using drag and drop. Your menu may therefore appear in a different order than shown here.
{% endhint %}
The **SIEM** menu is structured as follows:
{% columns %}
{% column width="33.33333333333333%" %}
{% endcolumn %}
{% column width="66.66666666666667%" %}
* [Data Lake](/docs/manual/english/platform-usage/siem/data-lake.md): The data lake serves as the central data source that consolidates, indexes, and groups all raw data collected from various logs by collectors.
* [Cockpits](/docs/manual/english/platform-usage/siem/cockpits.md): Here you can create custom dashboards for your SIEM or import managed Cockpits.
* [Incidents](/docs/manual/english/platform-usage/siem/incidents.md): Here you can find an overview of all events detected in the collected logs by workflows and alerts.
* [Workflows](/docs/manual/english/platform-usage/siem/workflows.md): Here you can define stream-based conditions that trigger an event when they are met.
* [Stream Catalogs](/docs/manual/english/platform-usage/siem/stream-catalogs.md): Stream catalogs group streams by topics, making it easier to manage the streams they contain. You can use stream catalogs managed by Enginsight or create custom stream catalogs.
* [Exports](/docs/manual/english/platform-usage/siem/exports.md): Here you can find all export files created from the data lake.
* [General Collectors](/docs/manual/english/platform-usage/siem/general-collectors.md):
* [Event Relays](/docs/manual/english/platform-usage/siem/general-collectors/event-relays.md): Here you can configure event relays that allow you to use the Enginsight agent Pulsar as a syslog relay. It receives syslog data from sources on which Pulsar cannot be installed.
* [Log Files](/docs/manual/english/platform-usage/siem/general-collectors/log-files.md): Here you can configure log file collectors that collect raw data from specific log files on selected hosts.
* [Host Collectors](/docs/manual/english/platform-usage/siem/host-collectors.md):
* [Windows Event Log](/docs/manual/english/platform-usage/siem/host-collectors/windows-event-log.md): Here you can configure Windows Event Log collectors that collect raw data from operating system-specific and vendor-specific logs on selected Windows hosts.
* [macOS Unified Logs](/docs/manual/english/platform-usage/siem/host-collectors/macos-unified-logs.md): Here you can configure collectors for macOS Unified Logs that collect raw data from operating system-specific logs on selected macOS hosts.
* [Linux Syslog](/docs/manual/english/platform-usage/siem/host-collectors/linux-syslog.md): Here you can configure Linux syslog collectors that collect raw data from syslogs on selected Linux hosts.
* [API Collectors](/docs/manual/english/platform-usage/siem/api-collectors.md): Here you can use and configure predefined collectors for supported vendors to collect raw data from connected cloud applications.
* [Advanced Settings](/docs/manual/english/platform-usage/siem/advanced-settings.md):
* [Streams](/docs/manual/english/platform-usage/siem/advanced-settings/streams.md): Here you can create log filters to selectively filter and display raw logs from the data lake.
* [Extractors](/docs/manual/english/platform-usage/siem/advanced-settings/extractors.md): Here you can create extractors that retrieve specific information from source fields in collected logs and write it to other target fields.
* [Custom Fields](/docs/manual/english/platform-usage/siem/advanced-settings/custom-fields.md): Here you can create custom fields to enrich log entries in the data lake with additional information.
* [BadIP Exceptions](/docs/manual/english/platform-usage/siem/advanced-settings/badip-exceptions.md): Here you can create rules to explicitly add specific IP addresses or entire subnets to an allowlist or blocklist.
* [Input Filters](/docs/manual/english/platform-usage/siem/advanced-settings/input-filters.md): Here you can create input filters for the Enginsight agent Pulsar when it acts as a collector for the SIEM. These filters remove irrelevant log data from selected hosts before it is sent to the SIEM.
* [Log TTLs](/docs/manual/english/platform-usage/siem/advanced-settings/log-ttls.md): Here you can define custom log retention periods for selected hosts.
* [Obfuscators](/docs/manual/english/platform-usage/siem/advanced-settings/obfuscators.md): Here you can create obfuscators that mask field values in selected fields.
* [Global Exceptions](/docs/manual/english/platform-usage/siem/advanced-settings/global-exceptions.md): Here you can create reusable data lake filters that exclude known or unwanted matches from your streams.
* [Identity Providers](/docs/manual/english/platform-usage/siem/advanced-settings/identity-providers.md): Here you can connect Enginsight to your Active Directory via LDAP or directly to Microsoft Entra ID.
* [Required Services](/docs/manual/english/platform-usage/siem/required-services.md):
* [Loggernaut](/docs/manual/english/platform-usage/siem/required-services/loggernaut.md): Here you can find an overview of all configured Loggernaut components required for all SIEM functions.
* [Tracer](/docs/manual/english/platform-usage/hosts/tracer.md):
* [Models](/docs/manual/english/platform-usage/siem/tracer/models.md): Here you can create custom models for Machine Learning-based monitoring and time-series analysis of streams.
* [Orchestration (SOAR) (BETA)](/docs/manual/english/platform-usage/siem/orchestration-soar-beta.md): Only visible if you have enabled beta features.
* [Playbooks](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks.md): Here you can create playbooks to orchestrate and automate more complex response processes for security-related events.
* [Flows](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/flows.md): Here you can find a list of all playbook runs.
* [LLM Providers](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/llm-providers.md): Here you can integrate LLM providers to use AI resources in the context of the data lake and in playbooks.
{% endcolumn %}
{% endcolumns %}
***
## Further Resources
**Knowledge Base**
* [Where do I find which Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/where-do-i-find-which-enginsight-logs)
* [How can I adjust the retention period for my log backups in the Enginsight SIEM?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-adjust-the-retention-period-for-my-log-backups-in-the-enginsight-siem)
* [How can I create an external backup of my raw logs in the Enginsight SIEM?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-create-an-external-backup-of-my-raw-logs-in-the-enginsight-siem)
* [How can I create SIEM clusters for suborganizations in Enginsight using geosplitting?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-create-siem-clusters-for-suborganizations-in-enginsight-using-geosplitting)
* [How do I add another SIEM Index Server in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-add-another-siem-index-server-in-enginsight)
* [How do I increase the disk size of the SIEM Index Server in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-increase-the-disk-size-of-the-siem-index-server-in-enginsight)
* [The connection to Apache Solr in the Enginsight SIEM keeps dropping. What can I do?](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/the-connection-to-apache-solr-in-the-enginsight-siem-keeps-dropping-what-can-i-do)
* [The Enginsight platform cannot connect to the SIEM. What can I do?](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/the-enginsight-platform-cannot-connect-to-the-siem.-what-can-i-do)
* [The Tracer in Enginsight shows a certificate error and does not connect. What can I do?](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/the-tracer-in-enginsight-shows-a-certificate-error-and-does-not-connect-what-can-i-do)
* [How do I configure an Enginsight SIEM extractor for an Apache HTTP Server?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-configure-an-enginsight-siem-extractor-for-an-apache-http-server)
* [How do I configure an Enginsight SIEM extractor for nginx?](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-do-i-configure-an-enginsight-siem-extractor-for-nginx)
* [How do I create an LLM provider for IONOS CLOUD AI in the Enginsight SIEM?](https://docs.enginsight.com/docs/knowledge-base/english/vendor-specific-guides/how-do-i-create-an-llm-provider-for-ionos-cloud-ai-in-the-enginsight-siem)
* [How do I configure Syslog notifications for the Enginsight SIEM in ESET PROTECT?](https://docs.enginsight.com/docs/knowledge-base/english/vendor-specific-guides/how-do-i-configure-syslog-notifications-for-the-enginsight-siem-in-eset-protect)
***
