Securing Systems using SIEM and FIM Tools

Vaishali Kumar, Abhishek Yadav and Shivam Bhorde

International Journal of Scientific Research in Science and Technology, 2024, vol. 11, issue 3, 613-621

Abstract: Today, computer networks are heavily documented security issues, making it impractical to manage them without Security Event Management (SIEM). A SIEM solution sets the controls everywhere, enhances information security, recording data from various devices and applications through agents or networks Protects data by aggregating and aggregating Provides filtering, normalization of redundant information it is proprietary, and they use context to analyze it. The SIEM solution provides threat detection and real-time system activity analysis, alerting operators in the event of an attack. Although there are high-quality SIEM solutions, success cannot be guaranteed. Instead, organizations should focus on a variety of use cases to effectively implement their SIEM solutions. Care must be taken with respect to the integrity of the operating system components. They are controlled to optimize system security. Attackers will always try to manipulate or alter these relevant resources to achieve their goals. System files are common targets for attackers. File integrity monitoring tools are often used to detect any malicious changes to these important files. In this project we developed a comprehensive security solution that combines a Security Information Event Management (SIEM) framework with a File Integrity Monitoring (FIM) tool to optimize the security posture of IT projects. Our SIEM project uses Azure Monitoring Agent to collect data from virtual machine and inject it into the Log Analytics Workspace. The FIM component is implemented by a Python script designed to scan multiple directories and files. The script initially stores the hashes of all monitored files in a baseline file named “baseline.txt” and creates backups of the original files. These backups are periodically updated, with old backups being deleted.

Keywords: Security Information and Event Management; File Integrity Monitoring; Log data management; Threat detection; Azure Monitoring Agent; Baseline file (search for similar items in EconPapers)
Date: 2024
References: Add references at CitEc
Citations:

Downloads: (external link)
https://ijsrst.com/home/article/view/IJSRST24113123 Abstract page (text/html)
https://ijsrst.com/home/article/download/IJSRST24113123/IJSRST24113123 Full text (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:etm:ijsrst:v11:y2024:i3:id:210

DOI: 10.32628/IJSRST24113123

Access Statistics for this article

More articles in International Journal of Scientific Research in Science and Technology from Technoscience Academy
Bibliographic data for series maintained by Pankaj Sharma ().