SIEM Logs as Digital Evidence: Reliability, Integrity, and Challenges in Cybercrime Investigations
DOI
Keywords
Abstract
Security Information and Event Management (SIEM) systems are widely used to collect, correlate, and analyse logs for cybersecurity monitoring and incident response. However, the growing reliance on SIEM data during digital forensic and cybercrime investigations raises important questions about whether such logs can be treated as reliable digital evidence. This paper examines the factors that influence the evidential value of SIEM logs through a conceptual research design supported by a structured integrative review of literature from cybersecurity, digital forensics, log management, incident response, and digital evidence preservation. The analysis develops four propositions relating to source-log quality, preservation and chain of custody, transparency of SIEM processing, and the effects of timestamp inconsistencies, weak access controls, incomplete logging, and deliberate manipulation. The findings show that SIEM evidential reliability depends on the entire logging lifecycle and not just on the kind of SIEM platform used. High-quality source logs, strong integrity controls, clear chain of custody procedures, and transparent correlation and normalisation processes strengthen evidential value, while incomplete records, weak preservation practices, and manipulation reduce confidence in forensic conclusions. The paper argues that SIEM platforms should be treated as part of a wider digital evidence ecosystem. Organisations should therefore incorporate forensic requirements into logging, preservation, and security-monitoring practices before incidents occur. Future empirical research should test the proposed relationships across different SIEM platforms and investigative environments.
References
Azahari, A., & Balzarotti, D. (2024). On the inadequacy of open-source application logs for digital forensics. Forensic Science International: Digital Investigation, 49, 301750.
Azam, H., Dulloo, M. I., Majeed, M. H., Wan, J. P. H., Xin, L. T., & Sindiramutty, S. R. (2023). Cybercrime Unmasked: Investigating cases and digital evidence. International Journal of Emerging Multidisciplinaries Computer Science & Artificial Intelligence, 2(1).
Caviglione, L., Wendzel, S., & Mazurczyk, W. (2017). The future of digital forensics: Challenges and the road ahead. IEEE Security & Privacy, 15(6), 12–17.
Dreier, L. M., Vanini, C., Hargreaves, C. J., Breitinger, F., & Freiling, F. (2024). Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49, 301755.
Guttman, B., White, D. R., Williams, S., & Walraven, T. (2022). Digital evidence preservation: Considerations for evidence handlers.
International Organization for Standardization (ISO). (2012). ISO/IEC 27037:2012 Information technology—Security techniques—Guidelines for identification, collection, acquisition and preservation of digital evidence.
Ismail, I., & Akram Zainol Ariffin, K. (2025). The admissibility of digital evidence from open-source forensic tools: Development of a framework for legal acceptance. PLoS One, 20(9), e0331683.
Jaakkola, E. (2020). Designing conceptual articles: four approaches. AMS Review, 10(1), 18–26.
Jansen, W., & Ayers, R. P. (2004). SP 800-72. Guidelines on PDA Forensics. National Institute of Standards & Technology.
Khan, S., Parkinson, S., & Murphy, C. (2023). Context-based irregular activity detection in event logs for forensic investigations: An itemset mining approach. Expert Systems with Applications, 233, 120991.
Kruse II, W. G., & Heiser, J. G. (2001). Computer forensics: incident response essentials. Pearson Education.
Măcăneață, C. (2024). Overview of security information and event management systems. Informatica Economica, 28(1), 15–24.
Nath, S., Summers, K., Baek, J., & Ahn, G.-J. (2024). Digital evidence chain of custody: Navigating new realities of digital forensics. 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), 11–20.
Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management. NIST Special Publication, 800.
Olegård, J., Axelsson, S., & Li, Y. (2025). When is logging sufficient?—Tracking event causality for improved forensic analysis and correlation. Forensic Science International: Digital Investigation, 52, 301877.
Patil, H., Kohli, R. K., Puri, S., & Puri, P. (2024). Potential applicability of blockchain technology in the maintenance of chain of custody in forensic casework. Egyptian Journal of Forensic Sciences, 14(1), 12.
Scarfone, K., & Souppaya, M. (2023). Cybersecurity log management planning guide.
Snyder, H. (2019). Literature review as a research methodology: An overview and guidelines. Journal of Business Research, 104, 333–339.
Torraco, R. J. (2016). Writing integrative literature reviews: Using the past and present to explore the future. Human Resource Development Review, 15(4), 404–428.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Ernest Kobbie Doe
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain the copyright of their articles published in this journal. All articles are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). This license permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are properly cited.