Custom SIEM Solution for Virtual Space Industries Using Splunk

Introduction

This project involves the development and analysis of a custom Security Information and Event Management (SIEM) solution using Splunk to protect the fictional organization, Virtual Space Industries (VSI), against cyberattacks. As part of a team of three SOC analysts at Fable CyberSecurity Inc., we were tasked with monitoring critical VSI systems, including Windows servers and an Apache web server. This project demonstrates our proficiency in security monitoring, log analysis, threat detection, and incident response using Splunk.

Table of Contents

• Project Overview
  • Objectives
  • Tools and Technologies
• Results and Findings
• Conclusion and Reflections

Project Overview

Objectives

The core objectives of this project were:

• Design a Security Monitoring Environment: Develop a Splunk-based SIEM solution to establish baselines, detect anomalies, and respond to cyber threats.
• Monitor Critical Systems: Collect and analyze logs from Windows servers and an Apache web server.
• Detect and Analyze Attacks: Identify and investigate simulated cyberattacks to assess the effectiveness of the SIEM.
• Provide Recommendations: Suggest improvements to enhance VSI's security posture based on analysis findings.

Tools and Technologies

• Splunk Enterprise
• Splunk Apps and Add-ons:
  • Splunk Add-on for Microsoft Windows
  • Splunk App for Windows Infrastructure
• Operating Systems:
  • Windows Server 2019
  • Ubuntu Server (Apache Web Server)
• Other Tools:
  • Wireshark
  • Python
  • Visualization Tools

For detailed reports and findings, please refer to the SIEM Implementation Report.

Results and Findings

• Successful Detection of Attacks: Detected multiple simulated cyberattacks, including brute-force login attempts, SQL injection attempts, and DoS attacks, using Splunk dashboards and alerts.
• Effective Monitoring and Analysis: Collected and analyzed logs from critical systems, establishing baselines and identifying anomalies.
• Actionable Insights: Provided recommendations to enhance security measures, such as strengthening password policies, implementing geo-blocking, and refining alert thresholds.

Conclusion and Reflections

This project demonstrated the critical role of SIEM solutions in detecting and responding to cyber threats. Working collaboratively as a team of three, we leveraged Splunk's capabilities to effectively monitor VSI's systems, detect simulated attacks, and provide actionable recommendations. The experience reinforced the importance of teamwork, continuous monitoring, proper configuration, and proactive security measures in cybersecurity operations.

---