What are two characteristics of a SIEM? (Choose two.)

A Security Information and Event Management (SIEM) system is defined by its core capabilities. "Log Management" is a foundational characteristic, encompassing the collection, aggregation, secure storage, and retention of log data from numerous sources. "Event Normalization & Correlation" is the key intelligence function of a SIEM. Normalization parses disparate log formats into a common, understandable structure. Correlation then analyzes these normalized events from multiple sources to identify related activities, patterns, and potential security threats that would not be apparent from a single data stream.

B: System deployment is a generic IT process for installing any software and is not a functional characteristic of a SIEM. C: Endpoint software patching is a function of dedicated patch management systems or Endpoint Detection and Response (EDR) tools. D: Enterprise user management is handled by Identity and Access Management (IAM) solutions like Active Directory or LDAP, not SIEMs.

1. NIST Special Publication 800-92, "Guide to Computer Security Log Management". (September 2006). Section 2.3, "Log Management Functions," details log collection, storage, and analysis. Section 5.2, "SIEM," explicitly describes its capabilities as including "log aggregation, normalization, and correlation."

2. IBM Security. (n.d.). "What is SIEM?". Official IBM documentation and product pages define SIEM as a solution that "collects log data...normalizes the data...and then correlates events" to detect security incidents. This aligns with options A and E.