The tools which receive event logs from servers, network equipment, and applications, and perform analysis and correlation on those logs, and can generate alarms for security relevant issues, are know

A network sniffer captures and inspects raw network traffic at the packet level, and does not collect or correlate logs from multiple disparate sources.

A vulnerability scanner probes systems to identify security weaknesses and misconfigurations, not to aggregate or correlate event logs.

An Intrusion Prevention System (IPS) monitors network traffic in real time and actively blocks malicious activity inline, rather than performing log aggregation and correlation across systems.

SIEM platforms collect and aggregate event logs from servers, network devices, and applications across an environment. They apply correlation rules and behavioral analytics to identify patterns that indicate security incidents, then generate alerts or tickets for analyst review. This centralized visibility and automated alerting capability is the defining function of a SIEM.