Aplicação de conceitos de SOC: implementação de SIEM com Elasticsearch

Abstract

With the current cybersecurity scenario, companies are invaded on a daily basis in a matter of seconds, but it can take between days and even weeks to detect these invasions. This detection deficit happens even among large enterprises where there are large budgets dedicated to security teams, tools and process creation. In the case of small and medium-sized companies, the use of security teams becomes unfeasible due to their high cost of implementation with specialized people, tools and processes. The main objective of this work was to develop a system using open source tools that allows the detection of security events in an automated way in real time. Along with the monitoring of security events, one of the objectives is the centralization of logs, making it possible to centralize the use of a visualization interface that allows a better analysis of the data, thus contributing to an improvement in the investigation of possible incidents. First, the tools that would be used were defined, defining the use of the Elk Stack software package. Next, the programming language was defined for the development of a script for querying and analyzing the data. During the development of the script, the creation of rules used to analyze the information in search of specific events was defined. Finally, the definition of the flow of sending informative alerts containing information about the detected events. Generating logs using the Linux auditing framework was able to collect 2,071,123 events on a host, consuming about 1.4 Gigabytes of disk space. An average of 49,312 events were collected daily. By running the monitoring script every hour, it was possible to identify 124 events involving the use of commands with elevation of administrative privileges. With the centralization of data, a data visualization interface was implemented, allowing queries from simple to complex, facilitating data analysis, in addition to the possibility of extracting reports with an infinity of filters. The development of this work made it possible to implement asset monitoring based on predefined events, creating and sending informative alerts. Another contribution is the improvement in the way of analyzing large volumes of data, extracting reports and identifying patterns.