title: ÐÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð² Ð·Ð°Ð´Ð°ÑÐ°Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ SIEM-ÑÐ¸ÑÑÐµÐ¼
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Application of large language models to the tasks of event analysis using SIEM systems
Creators: name: ÐÐ¾ÑÐ¸Ð½, ÐÑÑÐµÑÐ»Ð°Ð²
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð±Ð¾Ð»ÑÑÐ¸Ðµ ÑÐ·ÑÐºÐ¾Ð²ÑÐµ Ð¼Ð¾Ð´ÐµÐ»Ð¸
Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³ ÑÐ¾Ð±ÑÑÐ¸Ð¹
Ð¿ÑÐ°Ð²Ð¸Ð»Ð° Ð»Ð¾ÐºÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹
SIEM
LLM
RAG
large language models
event management
localization rules

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð¿ÑÐ¾ÑÐµÑÑÐ¾Ð² ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¿ÑÐ°Ð²Ð¸Ð» Ð¾Ð±-ÑÐ°Ð±Ð¾ÑÐºÐ¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÑ Ð² MaxPatrol SIEM Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ ÑÑÑÑÐ¾Ð¹ÑÑÐ²Ð¾ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¸ Ð¿Ð¾Ð´ÑÐ¾Ð´Ñ Ðº ÑÐ°Ð±Ð¾ÑÐµ Ñ Ð½Ð¸Ð¼Ð¸. 2. ÐÐ·ÑÑÐ¸ÑÑ ÑÐ¾ÑÐ¼Ð°ÑÑ Ð¿ÑÐ°Ð²Ð¸Ð» Ð½Ð¾ÑÐ¼Ð°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸ Ð¸ Ð»Ð¾ÐºÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ SIEM. 3. ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÑ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð² Ð·Ð°Ð´Ð°ÑÐ°Ñ Ð³ÐµÐ½ÐµÑÐ°ÑÐ¸Ð¸ Ð¿ÑÐ°Ð²Ð¸Ð» Ð´Ð»Ñ SIEM. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ðµ ÑÑÐµÐ´ÑÑÐ²Ð¾, Ð¾ÑÑÑÐµÑÑÐ²Ð»ÑÑÑÐµÐµ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¿ÑÐ°Ð²Ð¸Ð» Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÑ Ð² MaxPatrol SIEM Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ»Ð° ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ð°, ÑÐ¿Ð¾ÑÐ¾Ð±Ð½Ð°Ñ Ð³ÐµÐ½ÐµÑÐ¸ÑÐ¾Ð²Ð°ÑÑ Ð»Ð¾ÐºÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð² Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð½Ð¾Ð¼ ÑÑÐ¸Ð»Ðµ. ÐÑÐ¾Ð¼Ðµ ÑÐ¾Ð³Ð¾, ÑÑÐ¾ ÑÐ¸ÑÑÐµÐ¼Ð° Ð¸Ð· ÐºÐ°ÑÐµÑÑÐ²ÐµÐ½Ð½Ð¾ ÑÐ¾ÑÑÐ°Ð²Ð»ÐµÐ½Ð½Ð¾Ð³Ð¾ Ð·Ð°Ð¿ÑÐ¾ÑÐ° (Ð¿ÑÐ¾Ð¼Ð¿ÑÐ°) Ðº LLM Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÑÐµÑ ÑÑÐ¾ Ð¸ ÐºÐ°Ðº ÐµÐ¹ Ð½ÑÐ¶Ð½Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½Ð¸ÑÑ, Ð¾Ð½Ð°, Ð±Ð»Ð°Ð³Ð¾Ð´Ð°ÑÑ Ð²ÑÑÑÐ¾ÐµÐ½Ð½Ð¾Ð¼Ñ Ð¿Ð¾Ð¸ÑÐºÑ Ð¿Ð¾ Ð²ÐµÐºÑÐ¾ÑÐ½Ð¾Ð¼Ñ ÑÑÐ°Ð½Ð¸Ð»Ð¸ÑÑ ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð² ÑÐ²ÑÐ·ÐºÐ°Ñ Ñ Ð»Ð¾ÐºÐ°Ð»Ð¸Ð·Ð°ÑÐ¸ÑÐ¼Ð¸, Ð¿Ð¾Ð»ÑÑÐ°ÐµÑ ÑÑÐ¸Ð»Ñ Ð½Ð°Ð¿Ð¸ÑÐ°Ð½Ð¸Ñ Ð¿ÑÐ°Ð²Ð¸Ð» Ð»Ð¾ÐºÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð°Ñ ÑÐ¸ÑÑÐµÐ¼Ð° Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð° Ð½Ð° Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼Ðµ Ð³ÐµÐ½ÐµÑÐ°ÑÐ¸Ð¸ Ñ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¼ Ð¿Ð¾Ð¸ÑÐºÐ¾Ð¼ (Retrieval-Augmented Generation). ÐÐ°Ð½Ð½ÑÐ¹ Ð¼ÐµÑÐ°Ð½Ð¸Ð·Ð¼ Ð½Ðµ ÑÐ¾Ð»ÑÐºÐ¾ Ð½Ðµ ÑÑÐµÐ±ÑÐµÑ Ð½Ð°Ð»Ð¸ÑÐ¸Ñ Ð±Ð¾Ð»ÑÑÐ¾Ð³Ð¾ ÐºÐ¾Ð»Ð¸ÑÐµÑÑÐ²Ð° Ð²ÑÑÐ¸ÑÐ»Ð¸ÑÐµÐ»ÑÐ½ÑÑ ÑÐµÑÑÑÑÐ¾Ð², Ð½Ð¾ ÐµÑÐµ Ð¸ Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÐµÑ Ð±ÐµÐ· Ð±Ð¾Ð»ÑÑÐ¸Ñ Ð·Ð°ÑÑÐ°Ñ Ð°ÐºÑÑÐ°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð±Ð°Ð·Ñ Ð´Ð°Ð½Ð½ÑÑ, ÐºÐ¾ÑÐ¾ÑÐ°Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÑÑÑ Ð´Ð»Ñ ÑÑÐ°Ð½ÐµÐ½Ð¸Ñ Ð¿ÑÐ¸Ð¼ÐµÑÐ¾Ð² Ð¿ÑÐ°Ð²Ð¸Ð» Ð»Ð¾ÐºÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸. ÐÐ¾ Ð¿ÐµÑÐµÑÐ¸ÑÐ»ÐµÐ½Ð½ÑÐ¼ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÑÐ¼ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¼Ð¾Ð¶Ð½Ð¾ ÑÐ´ÐµÐ»Ð°ÑÑ Ð²ÑÐ²Ð¾Ð´ Ð¾ ÑÐ¾Ð¼, ÑÑÐ¾ Ð½ÐµÑÐ¼Ð¾ÑÑÑ Ð½Ð° ÑÑÐ»Ð¾Ð²Ð¸Ñ Ð¾Ð³ÑÐ°Ð½Ð¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð²ÑÑÐ¸ÑÐ»Ð¸ÑÐµÐ»ÑÐ½ÑÑ ÑÐµÑÑÑÑÐ¾Ð², Ð¸ÑÐ¾Ð³Ð¾Ð²Ð°Ñ ÑÐ¸ÑÑÐµÐ¼Ð° Ð¿Ð¾ÐºÐ°Ð·ÑÐ²Ð°ÐµÑ Ð´Ð¾ÑÑÐ¾Ð¹Ð½ÑÐ¹ ÑÐµÐ·ÑÐ»ÑÑÐ°Ñ.
description: The goal of the work is to automate the process of developing event processing rules used in MaxPatrol SIEM, using LLM. The tasks solved during the research: 1. Explore the structure of large language models and approaches to working with them. 2. Study the formats of normalization and localization rules used in modern SIEM. 3. Identify the subtleties in the tasks of generating rules for SIEM. 4. Develop a software tool that automates the development of event pro-cessing rules used in MaxPatrol SIEM using LLM. In the process of performing the work, it was determined which tasks the LLM models used in the work had difficulties with. These tasks were decomposed into components, and then the system architecture was changed. As a result, a system was implemented that is capable of generating event local-izations in a certain style. In addition to the fact that the system determines from a well-composed prompt to the LLM what and how it needs to perform, it, thanks to the built-in search through the vector storage of events in conjunction with localiza-tions, receives the style of writing localization rules. The developed system is built on the mechanism of generation with additional retrieval. This mechanism not only does not require a large amount of computational resources, but also allows updating the database used to store examples of localization rules without much cost. Based on the listed features of the developed system, it can be concluded that despite the conditions of limited computational resources, the final system shows a decent result.