Detect and Mitigate Cyberattacks Using SIEM

Cybersecurity is crucial to protect network resources and reduce the risk of cyberattacks like denial of service (DOS) and file modification. Security tools like intrusion detection and prevention systems (IDS and IPS), which work independently on network endpoints, struggle to distinguish between normal and anomalous network traffic in real-time, making cyberattack detection and prevention challenging. As a result, security information and event management (SIEM), which offers centralized network management, is utilized to gather and analyze logs from various endpoints on networks in order to identify threats in real time. This paper introduces a method integrating Wazuh and IDS tool capabilities to improve DOS detection and mitigation, and Wazuh file integrity monitoring (FIM) capabilities for real-time file modification detection. Wazuh monitors and evaluates network resource status centrally, while Snort and Suricata tools are used to monitor the network traffic on the monitored endpoint. After that, logs are sent to the Wazuh server for analysis and alerting. In addition, Wazuh is used to detect modifications to critical files, enabling early detection of malicious changes. The effectiveness of the suggested method is tested using a variety of DOS tools that are produced in real-time and by modifying important files. The experimental findings demonstrate that our method is effective in detecting and mitigating cyberattacks.