Scribd Logo
Upload

Welcome to Scribd!

  • 83 views

    Proposal Template

    Uploaded by

    archi oo7
    A SIEM solution should provide real-time and batch analytics to detect threats and anomalies across an organization's systems and data sources. It should integrate a variety of data collection methods, store large amounts of data, allow custom policies and rules to define normal behavior and anomalies, and correlate events to uncover meaningful security issues. The solution must also integrate with various applications and technologies, provide alerting capabilities, allow threat hunting, and include monitoring, logging, and reporting functions. It will utilize tools like Windows, Linux, VMware, Wazuh, Elasticsearch, Filebeat, Kibana, and agents.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Proposal Template

    Uploaded by

    archi oo7
    83 views3 pages
    A SIEM solution should provide real-time and batch analytics to detect threats and anomalies across an organization's systems and data sources. It should integrate a variety of data collection methods, store large amounts of data, allow custom policies and rules to define normal behavior and anomalies, and correlate events to uncover meaningful security issues. The solution must also integrate with various applications and technologies, provide alerting capabilities, allow threat hunting, and include monitoring, logging, and reporting functions. It will utilize tools like Windows, Linux, VMware, Wazuh, Elasticsearch, Filebeat, Kibana, and agents.

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    A SIEM solution should provide real-time and batch analytics to detect threats and anomalies across an organization's systems and data sources. It should integrate a variety of data collection methods, store large amounts of data, allow custom policies and rules to define normal behavior and anomalies, and correlate events to uncover meaningful security issues. The solution must also integrate with various applications and technologies, provide alerting capabilities, allow threat hunting, and include monitoring, logging, and reporting functions. It will utilize tools like Windows, Linux, VMware, Wazuh, Elasticsearch, Filebeat, Kibana, and agents.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    83 views3 pages

    Proposal Template

    Uploaded by

    archi oo7
    A SIEM solution should provide real-time and batch analytics to detect threats and anomalies across an organization's systems and data sources. It should integrate a variety of data collection methods, store large amounts of data, allow custom policies and rules to define normal behavior and anomalies, and correlate events to uncover meaningful security issues. The solution must also integrate with various applications and technologies, provide alerting capabilities, allow threat hunting, and include monitoring, logging, and reporting functions. It will utilize tools like Windows, Linux, VMware, Wazuh, Elasticsearch, Filebeat, Kibana, and agents.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 3

    Student ID

    Group Member 1: (BS180408584)


    Group Member 2 (Optional):
    [Leave this line blank if you want to do the project alone]

    Security Information and Event Management (SIEM) Solution

    Project Domain / Category:


    Cyber Security / Information Security, Logs analysis and Anomalies detection solution.

    Introduction:
    Cybersecurity risks affecting industrial control systems (ICT) have grown extremely during the past
    couple of years, mainly due to increased activity by nation-states and cybercriminals. Attackers have
    become more sophisticated and dangerous and their appropriate and timely detection has become
    a real challenge.
    Security Information and Event Management (SIEM) systems have been widely deployed as a
    powerful tool to prevent, detect, and react against cyber-attacks. SIEM solutions have grown to
    become comprehensive systems that provide a wide visibility to identify areas of high risks and
    proactively focus on mitigation strategies aiming at reducing costs and time for incident response.
    Currently, SIEM systems and related solutions are slowly converging with big data analytics tools.

    Functional Requirements:

    1. Analytics.
    SIEM tools use real-time analytics to detect and prioritize events or activities that may represent a
    threat, compliance issue or something else of interest to users. The solution should offer batch
    analytics to identify and correlate weak signals in data not detected in real time.

    2. Feature administration.
    The SIEM solution should provide tools to administer, maintain and support complex functions, such
    as log and data source management, analytics and detection content, reporting, user roles and
    access control, along with technical integration and response workflows.

    3. Data collection.
    SIEM systems collect data by deploying agents on end-user devices, servers, network equipment, or
    other security systems like firewalls and antivirus, or via protocols syslog forwarding or SNMP.
    Advanced SIEMs can integrate with cloud services to obtain log data about cloud-deployed
    infrastructure or SaaS applications, and can easily ingest other non-standard data sources.

    4. Data storage.
    SIEMs relied on storage deployed in the data center.

    5. Policies and rules.


    SIEM allows security staff to define rules, specifying how enterprise systems behave under normal
    conditions. They can then set rules and thresholds to define what type of anomaly is considered a
    security incident.

    6. Data consolidation and correlation.


    The central purpose of a SIEM is to pull together all the data and allow the correlation of logs and
    events across all organizational systems. An error message on a server can be correlated with a
    connection blocked on a firewall, and a wrong password attempted on an enterprise portal.
    Multiple data points are combined into meaningful security events, and delivered to analysts by
    notifications or dashboards.

    7. Integration.
    It may sound elementary, but it is also critical for any new SIEM tool to integrate with all relevant
    applications, data sources and technologies. SIEM threat detection performance depends not only
    on SIEM and its configuration, but also on the entire detection stack and all supporting telemetry
    chosen to be sent to the SIEM.

    8. Alerting.
    Analyzes events and helps escalate alerts to notify security staff of immediate issues, either by
    email, other types of messaging, or via security dashboards.

    9. Threat Hunting.
    Allows security staff to run queries from multiple sources via SIEM data, filter and pivot the data,
    and proactively uncover threats or vulnerabilities.

    10. Monitoring, logging, and tracking.


    SIEM solution provide proactive alerts on system events across all of your environments including
    cloud services, physical and virtual appliances and software, and combinations of these. It should
    also produce logging and resolution reporting on all issues.

    Tools:
    1. Windows 10.
    2. Windows server.
    3. Linux.
    4. VMware.
    5. Wazuh.
    6. Elasticsearch.
    7. Filebeat.
    8. Kibana.
    9. Agent.

    You might also like