Features of Creating a Virtual Laboratory for Developing and Applying Correlation Rules in Modern SIEM-Systems when Training Security Operation Center Analysts (by the Example of Microsoft Windows)

This paper proves the necessity of using a specialized virtual laboratory for effective training of future Security Operations Center (SOC) analysts. The lack of adequate information resources and integrated technical means complicates the training process and hinders the development of professional skills of trainees. The authors analyze the peculiarities of creating a virtual laboratory at the university and the advantages of its implementation in the educational process for the development and successful application of correlation rules in modern SIEM systems. As a result of the research, the necessary conditions for the functioning of the virtual laboratory were identified, which allows students not only to study modern technologies of anomalous activity detection, but also to develop and apply in practice correlation rules for SIEM-systems on the basis of conducting and analyzing various attacks on the Microsoft Windows operating system.