Cybersecurity — SIEM

What is SIEM?

Centralized logging and security monitoring.

Popular SIEMs

• Splunk
• ELK Stack
• QRadar
• Sentinel

ELK Stack setup

# docker-compose.yml
version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    environment:
      - discovery.type=single-node
    ports:
      - 9200:9200
  
  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    ports:
      - 5601:5601
  
  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    ports:
      - 5044:5044

Log forwarding

import logging
import logstash

logger = logging.getLogger('python-logstash')
logger.setLevel(logging.INFO)
handler = logstash.LogstashHandler('localhost', 5044, version=1)
logger.addHandler(handler)

logger.error('Security alert detected')

Alerts

{
  "alert": {
    "name": "Failed Login",
    "condition": "count > 5 in 5 minutes",
    "action": "notify SOC"
  }
}

Dashboards

1. Overview of security events
2. Threat detection metrics
3. User activity monitoring
4. Compliance reporting

Best practices

1. Centralize all logs
2. Create meaningful alerts
3. Regular tuning
4. Correlate events

Mini Practice

1. Set up ELK Stack
2. Forward logs
3. Create dashboards
4. Configure alerts

Up Next

Continue with Threat Intelligence - Threat data.