Grace
All projects
School project2024

Designing a SIEM

With two classmates, we designed and deployed a SIEM that collects security logs, detects attacks and raises alerts in real time.

Why we built it

A SIEM is how a security team sees what happens on its network. We wanted to build one end to end: attack a monitored network ourselves, then check that every step left a trace we could find, understand and alert on.

How it works

The eight steps of the SIEM: attack simulation with MITRE ATT&CK, log collection with Winlogbeat and Filebeat, processing with Logstash, storage and search with OpenSearch, dashboards, detection with Suricata, alerts with ElastAlert, and hardening.
Eight steps, from the simulated attack to hardening. OpenSearch is the open-source fork of Elasticsearch, and OpenSearch Dashboards plays the role of Kibana.

What we built

  • Built a monitored network of virtual machines, some acting as targets and others as attackers.
  • Simulated attacks such as scans, exploits and malicious files, and mapped each technique to the MITRE ATT&CK framework.
  • Collected and centralised logs with Filebeat, Winlogbeat and Logstash into OpenSearch, with OpenSearch Dashboards for visualisation.
  • Configured Suricata and ElastAlert to detect incidents and raise alerts in real time.
  • Hardened configurations and added security rules to block the attacks we had simulated.

Outcome

OpenSearch Dashboards showing the ElastAlert status for the Suricata intrusion rule over the last 24 hours.
Every simulated attack left a trace we could search and alert on. Here, ElastAlert runs our Suricata intrusion rule during the tests.