|
|
Tool for mapping computer infrastructure assets and designing SIEM correlation rules for security monitoring
Hrabálek, Matěj ; Caha, Tomáš (referee) ; Safonov, Yehor (advisor)
With the growing popularity of the SOC service, which often uses SIEM tools, new challenges arise regarding the implementation of these tools into individual infrastructures that can face cyber attacks. SIEM tools can detect cyber attacks only if they are configured correctly, i.e. they collect the right logs. This bachelor’s thesis is used for the facilitation of the process of implementing SIEM into the internal infrastructure. They discuss the appropriate categorization of log sources and correlation rules, the naming of correlation rules, and a system for mapping log sources to relevant correlation rules is proposed, which facilitates the implementation of SIEM into the infrastructure. All knowledge is then implemented into a web application, which is the practical output of this bachelor’s thesis. The web application allows the user, who is going to implement a SIEM service into their own infrastructure, to enter data about the infrastructure, especially log sources that can be generated in the infrastructure, and offers suitable correlation rules, including their naming, to the respective log sources. In addition to logs, SIEM technology and correlation rules, the theoretical part also discusses general knowledge from cyber security and describes the Security Operations Center.
|
guest ::
