| Popis: |
Namen diplomske naloge je predstaviti sistem SIEM (ang. Security Information and Event Management). Osredotočil sem se na funkcionalnosti sistema SIEM, ki so najpomembnejše za delovanje tega analitičnega orodja. Naloge SIEM-a so, da poenoti vse dnevniške zapise, ki jih dobi od drugih naprav, da korelira medsebojne podobne dogodke ter da ima možnost analitičnega prikaza dogajanja v omrežju preko nadzornih plošč in globlje analitske sposobnosti spremljanja dogodkov. Poleg naštetega je opisana arhitektura rešitve, ki predstavlja ključne korake pri delovanju sistema. Začetek procesa je izbira izvornih naprav za zbiranje dnevniških zapisov. Sledita razčlenjevanje in normalizacija, brez česar ni mogoče izvajati korelacije. Vsi gradniki arhitekture se med seboj dopolnjujejo in SIEM ne bi mogel delovati, če bi kateri manjkal. Zadnji del arhitekture je namenjen hranjenju dnevniških zapisov in spremljanju pomembnih varnostnih dogodkov in incidentov. Teoretično je predstavljenih tudi nekaj najpopularnejših produktov SIEM. Med njimi so na primer Splunk, IBM QRadar in sistem ArcSight, s katerim sem praktični del naloge tudi najbolj primerjal. V praktičnem delu diplomskega dela sta zajeta postavitev in delovanje odprtokodnega sistema AlienVault OSSIM. Podrobno so opisani koraki postavitve, poleg tega je preizkušeno obveščanje uporabnika s strani sistema ob nenavadnem dogajanju v omrežju. Sklepna ugotovitev glede na to, da je sistem brezplačen, je pozitivna. Preizkušeni sistem AlienValut OSSIM lahko manjša in srednja podjetja s pridom uporabijo za detekcijo različnih kibernetskih napadov. The purpose of this thesis is to present the SIEM (Security Information and Event Management) system. I have focused on the functionalities of the SIEM system, which are essential for the operation of this analytical tool. SIEM's mission is to unify all the logs it receives from other devices, correlate similar events, have the ability of analytical view on network events through dashboards and deeper analytical ability to monitor events. In addition, the solution architecture is described, which presents key steps in the process of system operation. The process begins with the selection of source devices from which we will then collect logs. The process of parsing and normalization follows. Without the last step we cannot build rules and perform correlations. All phases of the architecture complement each other and SIEM would not be able to function if any were missing. The architecture concludes with log retention as well as with monitoring important security events and incidents. Some of the most popular SIEM products are also theoretically presented. These include Splunk, IBM QRadar, and ArcSight, which I used to compare the practical part of this thesis the most. The practical part of this thesis covers the deployment and operation of the open source AlienVault OSSIM system. All the deployment steps are described in details as well as the alert testing. The conclusion after testing free system OSSIM is positive. The tested system AlienVault OSSIM can be used by small and medium-sized enterprises to detect various cyber-attacks. |
