Security Information and Event Management (SIEM) platforms centralize collection and correlation of security telemetry — logs, network flows, events, authentication records, cloud audit trails — from heterogeneous sources and generate prioritized alerts and incident cases for SOC investigation. Core capabilities include high-volume log ingestion at scale, rule-based and behavioral correlation (UEBA), detection-rule authoring and tuning, investigation and threat-hunting workflows, compliance reporting against security-relevant frameworks, and integration with response tooling (SOAR, EDR, email security). The category spans enterprise on-premises platforms (Splunk, IBM QRadar) and cloud-native SIEMs (Microsoft Sentinel, Google Chronicle, Panther, Exabeam).