The tools which receive event logs from servers, network equipment, and applications, and perform analysis and correlation on those logs, and can generate alarms for security relevant issues, are know

A network sniffer captures raw network packets for traffic analysis but does not aggregate logs from multiple sources or perform event correlation.

A vulnerability scanner probes systems to identify weaknesses and misconfigurations but does not collect or correlate operational event logs.

An Intrusion Prevention System (IPS) monitors and actively blocks malicious network traffic in real time but does not perform broad log aggregation and correlation across diverse sources.

SIEM platforms ingest event logs from servers, network devices, and applications, then apply correlation rules and analytics to identify suspicious patterns. When a potential security incident is detected, the SIEM generates alerts for security analysts to investigate, making it the technology that matches all characteristics described in the question.