Implantação de SIEM de código aberto em um ambiente corporativo: um estudo de caso

Abstract

Currently, Information Security has become something vital for the corporate environment, since, if any data compromise occurs, organizations are highly impacted financially. Therefore, it is important to invest in tools that can assist in the detection and remediation of the incidents mentioned, such as the Security Information and Event Management System (SIEM) through log management, correlating data and generating alerts, it is possible to predict threats beforehand. losses to the business. In the work in question, the use of an open-source tool, Wazuh, was established. It is an open-source solution with no licensing cost, aimed at detecting security incidents, through log management, generating dashboards. and highly efficient alerts. The case study was carried out on the devices of a large retail company, with several branches in Ceará. The tests were carried out, generating logs from firewalls, Active directory server and Operating System, aiming to validate the SIEM functionalities in the organization's daily life. With this practical study, it was possible to prove how easy it is to increase the maturity of an Information Security Team after adding log management to the organization's routine. This is because it does not require a high financial investment, just technical mastery and a committed team in improving yourself.