SolarWinds Security Event Manager
Security Event Manager
Stop threats with the right context—and less guesswork
- Centralize event logs, correlate activity in real time, and gain forensic visibility to strengthen your security posture.
- Use optional machine learning anomaly detection and global threat intelligence to help spot stealthy attacks.
- Contain threats in seconds with automated rules and simplify audits with prebuilt Query Packs.
Starts at
What is a security event manager?
Security event management software that collects, centralizes, correlates, and analyzes security events and log data to detect threats, automate responses, and demonstrate compliance. SolarWinds® Security Event Manager (SEM) gives lean IT and security teams an affordable, easy-to-deploy SIEM solution for day-to-day IT security and cybersecurity operations.
Learn more about security event management and SIEM
Enhance security and compliance with intuitive SIEM software
Elevate your security incident and event management with a simple and effective SIEM monitoring tool
Compliance
Make audit preparation predictable and easier to manage
Generate audit-ready compliance reports for PCI DSS, HIPAA, SOX, DISA STIGs, NERC CIP, and more using 300+ out-of-the-box templates. Schedule automated delivery to keep stakeholders informed and reduce manual audit prep with this sem reporting software.
- Generate audit-ready reports with 300+ pre-built, framework-specific templates.
- Schedule reports for automatic delivery or generate them on demand.
- Simplify preparation for audits across supported compliance frameworks.
Threat intelligence
Spot known threats before they gain a foothold
Correlation rules enhanced with a regularly updated threat intelligence feed help identify and tag malicious activity from known bad IPs. These cybersecurity capabilities help IT security teams prioritize risks without manual hunting or additional tools.
- Detect emerging threats using continuously updated threat feeds.
- Flag and tag suspicious traffic tied to known malicious IPs and bad actors.
- Focus investigations on critical risks with prioritized alerts.
Incident response
Contain threats in seconds—not hours
Active Response provides preconfigured actions—block IPs, disable accounts, kill processes, and detach USB devices—automatically when correlation rules fire. This incident response automation reduces containment time from hours to seconds without manual intervention.
- Block IP addresses, disable user accounts, kill processes, or detach USB devices.
- Sever malicious connections and instantly revoke compromised user privileges.
- Help stop lateral movement and protect critical data without manual delay.
Forensic analysis
Investigate faster with unified live and historical log search
Search live events and historical data in one place with keyword queries, out-of-the-box filters, and scheduled searches. This SIEM monitoring tool helps teams narrow in on the event logs that matter, speed up troubleshooting, and simplify investigations and audit preparation.
- Search live streams and historical archives through one unified view.
- Filter complex event trails to isolate the root cause.
- Save and schedule recurring searches for forensic reviews and audits.
File integrity
Detect unauthorized file changes before they become breaches
Built-in file integrity monitoring tracks changes to sensitive files, folders, and registry settings. Correlate file audit events with user activity to identify who changed what and when, helping teams investigate unauthorized access and limit the impact of insider threats.
- Detect unauthorized modifications across system files, folders, and registry entries.
- Pinpoint exact attribution to see who made changes and when they occurred.
- Correlate file audits with user context to expose insider threats and ransomware prep.
Get in-depth insights. Download the datasheet today.
How security event management works
Understand the mechanics behind threat detection, response, and reporting
Frequently asked questions
Is SolarWinds Security Event Manager a SIEM?
Yes. SolarWinds Security Event Manager (SEM) is a fully featured SIEM solution. It combines security information management—collecting, normalizing, and storing log data—with security event management, including real-time correlation, threat detection, and automated response. SEM delivers both SIM and SEM capabilities in a single virtual appliance, along with built-in compliance reporting for standards like PCI DSS, HIPAA, and SOX.
What can SolarWinds SEM monitor?
SEM monitors logs and events from hundreds of sources, including Windows and Linux servers, firewalls, IDS/IPS devices, network switches, routers, Active Directory, antivirus software, proxy servers, SQL databases, and USB devices. Pre-built connectors simplify collection from major vendors like Cisco, Palo Alto, Sophos, and Microsoft, while custom syslog sources can also be onboarded for monitoring.
How is SolarWinds SEM licensed?
SEM is licensed by the number of log-emitting nodes (servers, network devices, firewalls, and routers) rather than by log volume or data ingestion. This node-based model provides predictable budgeting and scalable licensing, so costs stay controlled even as log volumes grow. Workstation Edition licenses are also available for Windows desktop endpoint monitoring.
Is SolarWinds SEM the same as SolarWinds LEM?
SolarWinds Security Event Manager was formerly known as Log & Event Manager (LEM). The product was renamed to better reflect its SIEM capabilities and security focus. SEM is the current product name, and all new releases, features, and support reference SEM. Existing LEM customers can upgrade to current SEM versions without disruption.
How can we respond to cyberthreats faster?
SEM reduces response time through Active Response, which automatically executes preconfigured actions when correlation rules trigger. Responses include blocking IP addresses, disabling user accounts, killing malicious processes, detaching USB devices, and adjusting Active Directory settings. By automating containment, teams can reduce the impact of threats without waiting for manual intervention.
Can SEM help with PCI DSS compliance?
Yes. SEM includes out-of-the-box compliance reports and filters for PCI DSS, along with HIPAA, SOX, ISO, DISA STIGs, FISMA, FERPA, NERC CIP, and GLBA. Over 300 report templates are available, and reports can be scheduled for automated delivery or generated on demand. SEM also provides file integrity monitoring and user activity monitoring to support PCI DSS requirements for log collection, review, and retention.
Does SEM support file integrity monitoring?
Yes. SEM includes built-in File Integrity Monitoring (FIM) that tracks modifications, deletions, and permission changes to sensitive files, folders, and registry keys. FIM correlates file audit events with Active Directory data to identify which user accessed or changed a file, and what other activities occurred before and after the change—helping detect insider threats and support compliance requirements.
