Software that imports security event information from multiple data sources, normalizes the data, and correlates events among the data sources.
Source(s):
NIST SP 800-86