Which SIEM function stores logged data in a central repository for long-term compliance and for forensic analysis?

Which SIEM function stores logged data in a central repository for long-term compliance and for forensic analysis?

• A. Data Aggregation
• B. System and Device Log Monitoring
• C. Log Retention
• D. Object Access Auditing

Answer: (C)

Storing logged data in a central repository for long-term compliance and forensic analysis focuses on retention. In a SIEM, keeping logs for an extended period in one secure, centralized location ensures you can meet regulatory or organizational requirements and have the historical data needed to investigate incidents later. This central repository makes it possible to search across different sources, reconstruct events, and establish timelines, which is essential for forensics and audits. Retention policies define how long data stays, how it’s protected, and how it’s accessed, so investigators and auditors can rely on the integrity and availability of historical logs. Data aggregation is about pulling together data from multiple sources to summarize and correlate information for analysis, not specifically about long-term storage. System and device log monitoring refers to watching logs in real time for alerts and ongoing health checks, not the archival aspect. Object access auditing tracks who accessed particular files or resources, focusing on access events rather than archiving the entire log history.

Storing logged data in a central repository for long-term compliance and forensic analysis focuses on retention. In a SIEM, keeping logs for an extended period in one secure, centralized location ensures you can meet regulatory or organizational requirements and have the historical data needed to investigate incidents later. This central repository makes it possible to search across different sources, reconstruct events, and establish timelines, which is essential for forensics and audits. Retention policies define how long data stays, how it’s protected, and how it’s accessed, so investigators and auditors can rely on the integrity and availability of historical logs.

Data aggregation is about pulling together data from multiple sources to summarize and correlate information for analysis, not specifically about long-term storage. System and device log monitoring refers to watching logs in real time for alerts and ongoing health checks, not the archival aspect. Object access auditing tracks who accessed particular files or resources, focusing on access events rather than archiving the entire log history.