## 6 Repository Design  
The common _data repository_, provides a cross-layer integration of different components of the SIEM system [22].  
According to the research and development in data repositories area [23, 24, 25], we formulate the following basic functional requirements for the SIEM data repository:  
* Data storage;
* Metadata storage;
* Possibility to correct the metadata;
* Data management at different levels of detail;
* Concurrent access to data, based on privileges;
* Support of data integrity, confidentiality and consistency;
* Support of multi-version management.  
To implement the repository that satisfies the above requirements, we choose Service-Oriented Architecture (SOA), which is realized as a set of web services for data access in the repository. The advantages of this architecture are the flexibility and loose coupling of components, which provide high scalability and extensibility of the system.  
SOA is a concept of the distributed information environment that joins together various software modules and applications based on well-defined interfaces and contracts between them.  
The main principle of SOA is that the elements of business processes and elements of the information infrastructure, underlying them, are considered as components that are combined and repeatedly used as building blocks for the implementation of corporate processes.  
Figure 7 shows the general architecture of the repository, based on SOA, and its interaction with the other components of the SIEM system (_CRUD_ designates basic operations _Create_, _Read_, _Update_, and _Delete_).  
The main components of the SIEM system are as follows:  
* Event Processing Engine & Alert Correlator;
* Decision Support System;
* Threat Mitigation System;
* Visualization;
* Modeling Module, including the AMSEC.  
In accordance with the main principles of SOA, the repository architecture can be divided into two basic layers:  
* Repository storage layer and
* Repository service layer.  
The _Repository storage layer_ includes main data of the SIEM system. To support different information models developed in the MASSIF, we suggest using a hybrid approach in the repository storage layer [26].  
This approach combines the capabilities of relational DBMSs and triplet stores. The triplet store provides an ontological representation of the data model, and uses logical reasoning to select data. A hybrid approach is discussed in more detail in the next section.  
The _Repository service layer_ allows abstracting the interaction between one or more components of the SIEM system through an intermediate interface API. It consists of three modules:  
* data access module;
* presentation module and
* access control module.  
Figure 7: Repository architecture.  
The _data access module_ interprets the queries for data retrieval, received from the SIEM components in the language notation used by the DBMS.  
The _access control module_ checks access rights of generated queries to the repository according to the permissions defined for the tables and fields in the repository.  
The _presentation module_ covers everything that is related to the user interaction with the SIEM system. It can be implemented as a command line, text menu, or graphical interface designed as a rich client (Windows, Swing API, _etc._), or based on HTML. The main features of the presentation module are mapping of information and interpretation of user commands with their conversion into the corresponding operations in the context of the domain (business logic) and data source.