A SIEM solution works hand-in-hand with the auditing layer by aggregating audit information, in real time, from individual systems such as Active Directory engines, workstations and shared storage. As it is collected, programmable detection algorithms examine content and correlate activity across two or more systems. SIEM is often the best way to detect security breaches while there is still time to respond. In addition, SIEM systems provide the capacity to store large quantities of audit information that is useful for conducting routine facility security compliance audits or that might be used to conduct a post mortem investigation of a breach.