Cyber Range Team Capstone Project Summary - Sprint 5

Security Information and Event Management (SIEM) Learning

SIEM stands for Security Information and Event Management. It is a security solution that helps organizations detect, analyze, and respond to security threats before they harm business operations. SIEM combines both security information management (SIM) and security event management (SEM) into one security management system.

SIEM systems collect, analyze, and correlate security event information from various sources within an organization's IT infrastructure. These sources can include network devices, servers, firewalls, intrusion detection systems, antivirus software, and other security systems. The SIEM platform aggregates and normalizes the collected data, allowing security analysts to gain a holistic view of the organization's security status.

The Key functions of SIEM include:

• Collecting security data from a variety of sources, including network devices, servers, applications, and security appliances.
• Analyzing the collected data to identify potential threats and anomalies.
• Generating alerts when potential threats are identified.
• Investigating alerts to determine if they are malicious or benign.
• Taking action to mitigate threats, such as blocking traffic, quarantining systems, or resetting passwords.

SOC Analyst

Additional key functions are:

1. Log management: SIEM solutions collect and store log data from diverse sources, enabling centralized management and analysis of security events.
2. Real-time event correlation: The system correlates and analyzes security events in real time, identifying patterns and relationships that may indicate potential security threats.
3. Alerting and notification: SIEM systems generate alerts and notifications based on predefined rules or behavioral anomalies, enabling timely response to security incidents.
4. Incident response and investigation: SIEM platforms provide tools for incident response, allowing security teams to investigate security events, track the progression of an incident, and mitigate potential risks.
5. Compliance management: SIEM solutions assist organizations in meeting regulatory compliance requirements by collecting and analyzing relevant security event data and generating compliance reports.

SIEM is important and useful in cybersecurity for several reasons:

Threat Detection: SIEM systems enhance an organization's ability to detect and respond to security threats. By analyzing and correlating security events in real time, they can identify malicious activities, such as unauthorized access attempts, malware infections, or suspicious network behavior.

Incident Response: SIEM platforms provide incident response capabilities, enabling security teams to investigate and mitigate security incidents more efficiently. They help in identifying the scope of an incident, containing it, and applying appropriate remediation measures.

Centralized Visibility: SIEM solutions offer a centralized view of an organization's security posture. This enables security analysts to monitor and analyze security events from various systems and sources in a unified manner, providing better insights into potential threats.

Compliance: SIEM technology assists organizations in meeting regulatory compliance requirements. It helps collect, manage, and analyze security event data to generate compliance reports and demonstrate adherence to security standards and regulations.

Log Management: SIEM systems collect and store log data, which can be valuable for forensic analysis and investigating security incidents. Logs can provide crucial evidence for identifying the cause and impact of a security event.

SIEM plays a crucial role in cybersecurity by providing improved threat detection, incident response capabilities, centralized visibility, compliance management, and valuable log data for analysis and investigation.

Splunk is a leading SIEM (security information and event management) solution that collects, analyzes, and correlates network and machine logs in real time. Splunk is one of the most popular SIEM tool, but it is not the only one. There are a number of other SIEM tools available, and each has its own strengths and weaknesses.

Here are the list of the most popular SIEM tools (Enterprise and Open Source):

Enterprise SIEM Tools	Open Source SIEM Tools
Splunk Enterprise Security	AlienVault OSSIM
IBM QRadar	ELK Stack
Micro Focus ArcSight	OSSEC
LogRhythm NextGen SIEM Platform	Wazuh
Exabeam Fusion SIEM	Apache Metron
Securonix Singularity SIEM	MozDef
AlienVault Unified Security Management (USM)	Prelude OSS
SIEMonster SIEM	Snort
ManageEngine Log360	Asagan

Technical Documentation 🛠

Summary

Technical Documentation

Agile Framework ⚓

• Trello Stage 1
• Trello Stage 2
• Trello Stage 3

Team A Members 👩‍💻|👨‍💻

• Alena @alena
• Ameha @ameha01
• Diego @dagiraldo3
• Ella @ellaowens
• Emilie @emtechnode
• Gyan @gyan
• Jane @jjperipheral
• Jared @jared
• Maira @maira
• Nancy @nancyuddin
• Neiman @Neiman
• Victor @vick627
• Volha @voliatalatynik