A Comparative Study of Intrusion Events in Different SIEM Systems

Over the past decade, cyber threats have evolved significantly in the persistence and addressing of various vulnerabilities. Thus, they are the main weapon with which various information can be exploited whose attack phases include reconnaissance, identification of security tools and information exfiltration. Therefore, implementing an advanced intrusion detection system based on network elements has become an inevitable line of defense. Although traditional solutions are effective, new behavior-based anomalous activity detection approaches, such as SIEM -type systems or those based on different types of IDS, can provide an alternative solution for increasing the detection performance of new types of attacks. The problem with this type of system appears after the attack is identified. In addition to blocking the spread, it is also necessary to analyze malicious files so that their effect is blocked or diminished in the event of future attacks.