Abstract
Security Information and Event Management (SIEM) systems are widely used to prevent information loss in computer systems and networks. Currently, there are different approaches to building databases (data stores) for SIEM systems. Analysis has not revealed a universal type of database, and each has its advantages and disadvantages. This paper presents the rationale for selecting the most effective databases, based on which the model of an ontological-relational data store is implemented. The proposed model uses two different types of databases with appropriate characteristics, to improve the convenience of data storage and classification, to ensure high speed of obtaining large amounts of information through preliminary indexing, as well as load balancing and data replication. These results will be useful both for critical information infrastructure protection and for building various cyber threat monitoring systems.