Security · Visual Explainer
The SIEM Pipeline
The concept
A SIEM is a pipeline, not a product. Agents collect events from every endpoint; the manager decodes and correlates them against rules; the indexer stores them searchably; the dashboard is where humans hunt; and alert routing is where detection finally becomes action.
Key distinctions
| Term | What it means |
|---|---|
| Agents | Lightweight collectors shipping logs, file-integrity events and inventory from every host to the manager over an encrypted channel. |
| Manager | Decoders parse raw log lines into fields; rules match patterns and correlations, each with a severity and MITRE ATT&CK mapping. |
| Indexer | OpenSearch under the hood — alerts become searchable JSON. When it chokes, the whole SIEM goes blind. |
| Alert routing | The stage teams under-invest in: team-based routing, deduplication, and notifications that deep-link straight to the exact alert. |
Why it matters in practice
An alert nobody sees doesn't exist. The engineering value in a SIEM isn't installing it — it's tuning the rules and building the routing so the right person sees the right alert fast.