SIEM (Security Information and Event Management) systems are responsible for aggregating logs from network devices, servers, and applications and performing real-time correlation analysis to detect threats, but they commonly face challenges such as high storage costs and short historical data retention periods.