Question 1

Is a SIEM a SOC?

Accepted Answer

No, a SIEM is a platform. A SOC is the operating unit with people, processes and response.

Question 2

Does XDR replace SIEM?

Accepted Answer

XDR replaces SIEM in many cases; see [What is XDR](/en/soc/what-is-xdr). Compliance and long-term retention often still require SIEM.

Question 3

How long are logs retained in a SIEM?

Accepted Answer

A SIEM typically retains logs for 12 months in warm storage and 24 to 36 months in cold storage. FINMA-regulated institutions often retain logs longer; see [SOC and FINMA](/en/soc/soc-finma-requirements).

Question 4

Why is SIEM often perceived as expensive?

Accepted Answer

Licence costs grow with ingest volume, and poor data selection inflates that volume. Well-calibrated ingest pipelines materially reduce costs; see [SOC cost Switzerland](/en/soc/soc-cost-switzerland).

Question 5

Is Microsoft Sentinel a SIEM?

Accepted Answer

Yes, Microsoft Sentinel is a cloud-native SIEM that integrates tightly with M365. See [Microsoft Sentinel](/en/soc/soc-microsoft-365-sentinel) for details.

Context