Scalable security information and event management (SIEM) framework

A framework for security information and event management (SIEM), the framework comprising:

• at least one processor;
• memory, operatively connected to the at least one processor storing instructions that, when executed by the processor, cause the framework to perform operations:
• a first data store;
• one or more parsing mechanisms;
• one or more correlation machines;
• and
• one or more workflow engines,
• wherein said framework performs SIEM on behalf of multiple subscribers to said framework, and
• wherein said first data store is constructed and adapted to store log data obtained from at least some of said multiple subscribers, and
• wherein said one or more parsing mechanisms are constructed and adapted to obtain log data from said first data store and to normalize said log, and
• wherein said one or more correlations machines are constructed and adapted:
• to obtain normalized log data, and to apply one or more correlation rules to said normalized log data to determine one or more correlations, and to put information about said one or more correlations on a correlations queue;
• and
• wherein said one or more workflow engines are constructed and adapted to obtain said information about said one or more correlations from said correlations queue and to determine ticket information based on said information about said one or more correlations, and to provide said ticket information to a subscriber of said multiple subscribers.