Deployment of open source SIEM system for small and medium business enterprises

Mansurov Alexandr Valerievich, Shabala Egor Evgenevich

SIEM system is a necessity for business enterprises to aggregate and process all the data essential for cyber security incidents investigations. Small and medium business often cannot bear the costs of commercial SIEM systems, so the only option available is to look for alternatives. In this paper, the open source SIEM system is proposed. The proposed SIEM system is capable to collect all the data and perform an automatic and manual analysis and event correlation, thus, is deemed to be suitable to act as a competent SIEM system. It provides the necessary analysis tools for effective cyber security incidents processing and generating reports and alerts for cyber security personnel of small and medium business enterprises.

Keywords:SIEM, security incident, Suricata, ELK, Wazuh.