# Enhancing Cloud Security--Proactive Threat Monitoring and Detection Using a SIEM-Based Approach
## 1 Introduction
(6) Recover--restore assets and operations that were impacted by a cybersecurity incident. One of the tools that can be leveraged to achieve some of these security outcomes is the SIEM system. SIEM stands for security information and event management. SIEM systems collect, aggregate, and analyze data from various sources, such as logs, events, alerts, and incidents, and provide security teams with a centralized view of an organization's security posture, enabling security teams to identify, investigate, and remediate potential security incidents more effectively. The traditional deployment method for SIEM systems is self-managed on-premises. This mandates that organizations conduct a thorough assessment of the magnitude of the log and event data they produce, as well as the necessary system resources for their efficient management. Following the surge in cloud computing adoption, most major SIEM vendors now offer a cloud-based version of their products. This gives organizations the option to deploy SIEM solutions either on-premises or in the cloud. However, cloud-based SIEM solutions that were originally designed for traditional IT environments may not be well suited to cloud environments. This is because cloud infrastructures have unique characteristics and requirements that may not align with the capabilities and configurations of traditional SIEM systems. For example, cloud environments are dynamic, scalable, heterogeneous, distributed, and multi-tenant, which makes it difficult to collect and analyze data from various sources and locations. Cloud environments also have specific data types and formats that are not supported by traditional SIEM solutions. Some of the major cloud service providers have proactively anticipated these challenges and have recently started to introduce cloud-native SIEM solutions. Examples include Chronical SIEM for Google Cloud [15] and Microsoft Sentinel for Microsoft Azure [16]. These cloud-native SIEM solutions are purpose-built for the cloud environment from the start, utilizing microservice architectures and incorporating cloud-specific analysis methods and detection capabilities. These cloud-native solutions are deemed essential. However, it is still the responsibility of cloud consumers to take the necessary steps to integrate SIEM solutions into their cloud environment. Considering the persistent and widespread risk of encountering threats and malicious activities in any cloud computing infrastructure, establishing a cloud-native centralized system for monitoring, detecting, and responding to security threats is critically important. Therefore, as a part of our contribution, we present an architectural deployment framework that integrates a cloud-native SIEM solution within a public cloud environment. We propose and demonstrate in an empirical way a security design for internet-exposed infrastructure elements that need to reside behind a web application firewall (WAF), but also describe the steps for setting up a cloud-based Security Operation Center (SOC) leveraging cloud-native solutions. Beyond threat monitoring and detection, the framework encompasses a module for compliance assessment. This component evaluates compliance with pertinent industry standards and regulatory requirements, ensuring that the deployed cloud infrastructure aligns with the necessary criteria for compliance. The rest of this paper is structured as follows: Section 2 provides a comprehensive review of the related works in the field, emphasizes the research gap, and sets the stage for our contribution. Section 3 presents the method, materials, and steps employed to design the proposed architecture. Section 4 discusses the results obtained from the deployed system, demonstrating the effectiveness and limitations of the proposed model. Finally, in Section 5, we provide the concluding remarks and future direction.