Regarding the possibilities of implementing the joint functioning of LMS and SIEM manage-ment based on free open-source tools
Year: 2025
Type: article
Abstract: The article is devoted to solving the problem of cybersecurity of corporate IT infrastructure by using the concept of security operations centers. For modern SOCs (Security Operations Centers), the main monitoring, threat detection and response technology is based on SIEM (Security Information and Event Management) systems, which combine event information from all security tools and have a lot in common with LMS (Log Management Systems). In general, LMS and SIEM are focused on different tasks but have a common information base in the form of log data and partially overlap in the capabilities of performing security monitoring functions. The article provides an overview of the available free open-source tools for the implementation of modern SIEM functions in connection with typical SOC processes and compatible operation with LMS. Functions and typical SOC processes are considered. An appropriate instrumental basis for the implementation of processes is represented by the evolutionary scheme of SIEM development proposed by Gartner. The absence of a free full-featured SIEM platform in the existing and expected offers of the leaders of the modern market of corresponding software (according to the magic quadrant of Gartner-2024) justifies the limitation of the possibilities of solving the given task using the available separate tools, their adaptation, gradual development, and integration within the framework of a single platform. A review of available sources on existing free open-source tools for implementing the basic functions of SIEM and IRP, SOA, TIP, and UEBA platforms has been conducted. According to the authors, these tools primarily deserve attention in the context of the given task. It is noted that against the background of a huge number of paid tools, the share of free ones is quite large, and there are corresponding offers in each nomination of the Gartner scheme. For the first stage of creating a full-featured SIEM, an ELK-OSSIM integration solution is proposed with further gradual development and integration of SOA–SOAR components. At the first stage, such a solution should ensure the performance of the functions of vulnerability assessment, intrusion detection, event correlation, behavioral monitoring, threat intelligence, long-term intelligence analysis, etc.
Authors: V.A. Lytvynov, I.M. Oksanych, S.V Hrybkov
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W4411419935