{"id":4359,"date":"2021-10-12T22:47:48","date_gmt":"2021-10-12T14:47:48","guid":{"rendered":"http:\/\/mayanknauni.com\/?p=4359"},"modified":"2021-10-12T23:02:12","modified_gmt":"2021-10-12T15:02:12","slug":"security-ops-centre","status":"publish","type":"post","link":"https:\/\/mayanknauni.com\/?p=4359","title":{"rendered":"Security Ops Centre"},"content":{"rendered":"
Disclaimer:- This note was written by me ( Mayank Nauni)\u00a0in my personal capacity. The opinions expressed in this article are solely my own and do not reflect the view of my employer or my preference towards any of the OEMs.<\/em><\/strong><\/h5>\n

<\/a>Introduction<\/h1>\n

The recent rise in cyber-attacks, together with tighter security regulations required from organizations, are making SOC (Security Operations Centre) a standard security approach which is being adopted by an increasing amount of organizations. SOC is more of the physical aspect and the technology is mostly called SIEM, which in effect is a security system comprised of multiple monitoring and analysis components meant to help organizations detect threats and mitigate them. SIEM is not a single tool or application but a set of different building blocks that all constitute part of a system. There is no standard SIEM protocol or established methodology, but most SIEM systems will comprise of elements such as aggregation of logs from various sources, normalization of those logs in a common format, then correlating events to connect the dots and detect attacks and finally visualize the data in dashboards for easy viewing by analysts. This project involves the creation of an internal network with some benign clients and servers with an external malicious attacker(s) launching different types of attack. The network can either be done through either connected VMs or Mininet or some other network virtualization tool. The goal is to use an open-source SIEM in the internal network to detect the attacks.<\/p>\n

A Security Information Manager is a tool that correlates information producing a higher confidence level for when an attack occurs. In the open source community, various tools have been created to monitor different aspects of security. OSSIM combines the data from these tools correlating it to a higher confidence when an attack occurs, or a host has been compromised and uses the data to determine the health of our network. It integrates Host Intrusion Detection Systems (HIDS) with Network Intrusion Detection Systems (NIDS) to do this.<\/p>\n

 <\/p>\n

<\/a>Lab Setup and Topology<\/h2>\n

The network topology is set up using GNS3 Emulator as a tool to simulate a security operation centre\u2019s environment. The following are the devices and virtual machines (VM).<\/p>\n