SIEM-ENABLED CYBER EVENT CORRELATION (WHAT AND HOW)
Loading...
Authors
Myers, Kurt J.
Christopher, Fidel E.
Subjects
Security Information and Event Management
incident detection
log analysis
incident detection
log analysis
Advisors
Fulp, John D.
Singh, Gurminder
Date of Issue
2018-06
Date
Publisher
Monterey, CA; Naval Postgraduate School
Language
Abstract
This capstone evaluates the capabilities and potential usefulness of a Security Information and Event Management (SIEM) system in the detection of malicious network activities. The emphasis of this project was to select and configure a Free and Open Source SIEM (FOSS) to perform automated detection and alerting of malicious network events based upon predefined indicators of compromise. To test these functionalities, a virtual lab network consisting of a combination of Windows servers and Windows and Linux workstations was built to provide a proof-of-concept environment for testing the chosen FOSS SIEM. From within the lab network, a series of malicious cyber actions were executed to evaluate how well our configured FOSS solution detected and reported them. As SIEM solutions are increasingly deployed to help automate cyber defense, we hope this study motivates the adoption of FOSS solutions by organizations that may not be able to afford a commercial solution, or—perhaps— may simply prefer the advantages of free and open-source solutions.
Type
Thesis
Description
Series/Report No
Department
Information Sciences (IS)
Information Sciences (IS)
Organization
Identifiers
NPS Report Number
Sponsors
Funder
Format
Citation
Distribution Statement
Approved for public release; distribution is unlimited.
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.