Security Information and Event Management (SIEM)

Security information and event management is a platform that collects, normalizes, and correlates log and event data from across a network to detect threats and produce alerts and audit records. In a fleet it ingests feeds from shipboard IT and OT systems, firewalls, and shore infrastructure, supporting the Detect and Respond functions behind IMO MSC-FAL.1/Circ.3 and the logging required by IACS UR E26. The shipboard constraint is bandwidth: edge collection buffers events locally and forwards on satellite connection rather than streaming continuously.