Traditional SIEM systems provide:

Traditional Security Information and Event Management (SIEM) systems are designed to provide a centralized view of an organization's security posture. Their fundamental, long-standing functions are to collect and aggregate log data from various network devices and systems. This data is then normalized into a common format for easier processing. The core value of a traditional SIEM lies in its correlation engine, which applies predefined rules to identify relationships between disparate events that may indicate a security incident. When a correlation rule is met, the system generates an alert to notify security personnel for further investigation. These four functions—Aggregation, Normalization, Correlation, and Alerting—form the foundational data processing pipeline of a traditional SIEM.

A: These are advanced features of User and Entity Behavior Analytics (UEBA) platforms, often integrated into next-generation SIEMs, not traditional ones. C: These are specialized functions performed by malware analysis tools or sandboxes, which are separate technologies from SIEM. D: These are core capabilities of Identity and Access Management (IAM) and Privileged Access Management (PAM) solutions, not SIEM systems.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-92

Guide to Computer Security Log Management.

Section 2.2

"Log Management Functions

" describes the key functions including log collection (aggregation)

parsing (a component of normalization)

and analysis (which encompasses correlation and alerting). This document outlines the foundational principles upon which SIEM technology is built.

2. Kent

K.

& Souppaya

M. (2006). Guide to Enterprise Telework

Remote Access

and Bring Your Own Device (BYOD) Security (NIST Special Publication 800-46 Revision 2). National Institute of Standards and Technology.

Section 5.3.2

"Security Information and Event Management

" states

"SIEM products provide the ability to gather security data from information system components... and to centralize the data to facilitate correlation and analysis for detecting trends and security events." This explicitly mentions the core functions.

3. Lund

M.

& Solms

S. V. (2011). A model for early warning and response to information security incidents. In Proceedings of the 10th European Conference on Information Warfare and Security (pp. 196-204). Academic Conferences International Limited.

This academic paper discusses the architecture of security systems

describing the SIEM process as involving the collection of events from sensors (aggregation)

filtering and normalization of data

and correlation to identify incidents

which then leads to alerts. This aligns directly with the functions listed in option B.