Um estudo sobre soluções de ataques cibernético com SIEM Com foco na plataforma Splunk

Abstract

The overall objective of this study was to conduct a bibliographic review and describe the functionalities of the Splunk tool in detecting, responding to, and preventing cyberattacks. Regarding methodological aspects, in its technical procedures, this research is bibliographic and documentary. The study highlighted a growing concern about cybersecurity, the damage these attacks can cause to companies in terms of data loss and theft, as well as financial losses. There are various cyberattack techniques, some of the most common being phishing, DDoS, and ransomware, demonstrating the attackers’ constant adaptation to security measures. Some models describe the stages of a cyberattack—two of them are the MITRE ATT&CK and the Cyber Kill Chain. These models enable organizations to better understand the attackers' tactics. A SIEM centralizes and correlates security log events from various sources, allowing for more comprehensive analysis and the identification of suspicious patterns. The SOC is responsible for monitoring the organization's entire technological infrastructure, while SOAR seeks to bring automation to many common manual tasks to enhance efficiency and consistency in security operations. It is concluded that a SIEM centralizes and correlates security log events from various sources, allowing for a broader analysis and identification of suspicious patterns. Splunk is a highly scalable and efficient SIEM, with advantages in indexing and searching log files, facilitating the analysis of large volumes of data. Moreover, cyber forensic science involves extracting information, analyzing data, and obtaining intelligence that can be presented in court as evidence, ensuring legal compliance and the implementation of audit policies. This preserves information integrity and enables connections to be made between practices that might facilitate criminal activities. It was concluded that companies can enhance cybersecurity and reduce risks by using Splunk as a SIEM. This tool allows for the centralization and correlation of security events, enabling real-time analysis, identification of malicious patterns, and advanced log management. With all these capabilities for analyzing large volumes of data, Splunk proves to be highly useful for companies in protecting against cyber threats.