The Analysis of Attacks Against Port 80 Webserver with SIEM Wazuh Using Detection and OSCAR Methods

The existence of the internet in the company leads data and information exchange activities easier. The ease to obtain company data and information which is not accompanied by information security awareness results in the emergence of data leaks and lateral movements. Companies are required to ensure reliable and secure network security to protect information technology assets from hacking. SIEM assists the companies and security officers to monitor attacks, find vulnerabilities and analyze attacks. This study applies a network forensic approach with OSCAR and detection methods to determine the effectiveness of SIEM wazuh performance against port 80 attacks on the web server. The attack testing stages of port scanning and http directory scanning, the web server service still looks normal or no 404 error message is found in the browser. The deviation of attack detection in this study is 1.402 seconds. The existence of SIEM Wazuh is able to assist security officers in monitoring company data security and securing company IT assets.