SIEM

A SIEM collects security-relevant events from everywhere into one place so they can be searched and correlated.

The value is being able to ask a question across the whole estate at once, which is impossible when logs sit on individual machines. The disappointment is that buying one does not produce detection: it produces a very expensive place to keep logs. What turns it into security is the detections written on top, and that work is usually underestimated by an order of magnitude.