title: Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° ÑÐ°ÑÐ¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð½Ð¾Ð¹ SIEM-ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ±Ð¾ÑÐ° Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð»Ð¾Ð³Ð¾Ð² Ð´Ð»Ñ ÑÐµÑÐ¸ ÑÑÑÑÐ¾Ð¹ÑÑÐ² Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ð¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Development of a Distributed SIEM System for Log Collection and Analysis for anOrganizationâs Device Network
Creators: name: ÐÑÐ¾ÐºÐ¸Ð½, ÐÐ¼Ð¸ÑÑÐ¸Ð¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: SIEM
Wazuh
open source
Ð°Ð½Ð°Ð»Ð¸Ð· Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
Ð°Ð½Ð°Ð»Ð¸Ð· Ð»Ð¾Ð³Ð¾Ð²
Android
security analysis
log analysis

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ SIEM-ÑÐ¸ÑÑÐµÐ¼Ñ Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð´Ð°Ð½Ð½ÑÑ Ð¾ Ð¿Ð¾ÑÐ¾ÐºÐ°Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸ Ð¸ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¼Ð¾Ð±Ð¸Ð»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð´Ð°Ð½Ð½ÑÑ ÐºÐ¾Ð¼Ð¿Ð°Ð½Ð¸Ð¸, ÐºÐ¾ÑÐ¾ÑÑÐµ Ð² ÑÑÐ»Ð¾Ð²Ð¸ÑÑ ÑÐ°ÑÑÑÑÐ¸Ñ ÐºÐ¸Ð±ÐµÑÑÐ³ÑÐ¾Ð· Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÑ ÑÐ»ÑÑÑÐ¸ÑÑ Ð·Ð°ÑÐ¸ÑÑ Ð¸ Ð²ÑÑÐ²Ð»ÑÑÑ ÑÐºÑÑÑÑÐµ ÑÐ³ÑÐ¾Ð·Ñ Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ: ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ SIEM-ÑÐ¸ÑÑÐµÐ¼ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ open-source ÑÐµÑÐµÐ½Ð¸Ð¹. Ð¡ÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐ°ÑÐ°ÐºÑÐµÑÐ¸ÑÑÐ¸Ðº ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ SIEM-ÐºÐ¾Ð¼Ð¿Ð¾Ð½ÐµÐ½ÑÐ¾Ð². Ð£Ð»ÑÑÑÐµÐ½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐµÐ¹ ÑÐ¸ÑÑÐµÐ¼Ñ, Ð¿ÑÑÐµÐ¼ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ¸ ÐºÐ¾Ð½ÑÐ¸Ð³ÑÑÐ°ÑÐ¸Ð¸, ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¼Ð¾Ð´ÑÐ»Ñ Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ eBPF, Ð° ÑÐ°ÐºÐ¶Ðµ ÑÐ¾Ð¿ÑÑÑÑÐ²ÑÑÑÐ¸Ñ ÑÑÐµÐ´ÑÑÐ² Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼Ð¾Ð±Ð¸Ð»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ñ ÑÐµÑÐ²ÐµÑÐ¾Ð¼ Wazuh. Ð Ð°Ð±Ð¾ÑÐ° Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð° Ð½Ð° Ð±Ð°Ð·Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ ÑÐµÑÐ½Ð¾Ð»Ð¾Ð³Ð¸Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½ÑÐ¾Ð² ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ñ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ, Ð²ÐºÐ»ÑÑÐ°ÑÑÐ¸Ðµ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¹ Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÑ, Ð° ÑÐ°ÐºÐ¶Ðµ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ SIEM Ð¸ Ð¼Ð¾Ð±Ð¸Ð»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð°Ñ ÑÐ°ÑÑÑ SIEM-ÑÐ¸ÑÑÐµÐ¼Ñ, Ð¾Ð±ÐµÑÐ¿ÐµÑÐ¸Ð²Ð°ÑÑÐ°Ñ ÐµÑ ÑÐ°Ð±Ð¾ÑÑ Ð² ÑÐ¾Ð¾ÑÐ²ÐµÑÑÑÐ²Ð¸Ð¸ Ñ Ð·Ð°Ð´Ð°Ð½Ð½ÑÐ¼Ð¸ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ°Ð¼Ð¸, Ð° ÑÐ°ÐºÐ¶Ðµ ÑÐ¾Ð·Ð´Ð°Ð½Ð¾ Ð¼Ð¾Ð±Ð¸Ð»ÑÐ½Ð¾Ðµ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ðµ, Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÑÑÐµÐµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ ÑÑÑÑÐ¾Ð¹ÑÑÐ²Ð° Ð½Ð° ÑÐµÑÐ²ÐµÑÐµ Wazuh.
description: This work is dedicated to the development of a SIEM system for data flow analysis and the creation of a mobile application to enhance company data security. In the context of growing cyber threats, these tools will improve protection and help identify hidden threats in information systems. Tasks addressed during the work: Analysis of existing SIEM systems using open-source solutions. Comparative analysis of the characteristics of various SIEM components. Improvement of the existing system by configuring settings, developing an eBPF processing module, and associated information processing tools. Development of a mobile application for interaction with the Wazuh server. The work is based on the analysis of modern information security technologies and development tools. Research was conducted, including the analysis of existing solutions as well as the development and testing of the SIEM system and the mobile application. The following results were achieved: Developed the software part of the SIEM system, ensuring its operation in accordance with specified settings. Created a mobile application that allows analyzing device security on the Wazuh server.