Security Operation Center (SOC) Guide for SOC Analyst – SIEM Tools & Use Cases Overview

This blog helps you to understand the operational goal of SOC and how we can build use cases using Splunk (one of the famous SIEM tools). This blog will help Student, Fresher, Industry Expert who wants to work for the Security Operation Center.

What is security Operation?

Security Operation is the continuous operational practice for maintaining and managing a secure IT environment through the Implementation and execution of certain services and process its main purpose is to detect, prevent, prioritize and respond to security incidents. here you can refer How to Build and Run a Security Operations Center

Security Operation Consist of various security operation tasks, which include

• Security Monitoring
• Security Incident Management
• Vulnerability Management
• Security Device Management
• Network flow Monitoring

Security Operation Center

SOC is a centralized unit and a single point of view through which an organization’s assets are monitored, assessed, and defended from the threats. It also facilitates situational awareness and real-time alerting if any intrusion or attack is detected.

SOC capabilities

• Situational Awareness and operational intelligence – SOC provides information about what is going on across the different parts of IT infrastructure. It also provides Operational intelligence about IT infrastructure.
• Threat control and prevention – Using Internal and external resource it provides the knowledge of IOC’S (Indicator of compromise) of attacks this enables SOC to provide Threat control and prevention.
• Forensics – SOC analysts use structured log data to conduct an investigation and understand the root cause of the attack and also restrict the attacker’s ability to perform an attack against the organization.

What Operations carried out in Security Operation Center?

1. Log Collection – Logs are collected from the various devices on a network that can have an impact on the security of the organization.
2. Log Retention and Archival – Collected logs are stored centrally and logs always have Retention and Archival period for better management.
3. Log Analysis – logs are analyzed through different SOC technology to extract information from raw data.
4. Monitoring of Security Environments for security Events – Information received by log analysis is transferred to the SOC team for monitoring purposes so that it can be used to identify the current security position of an organization.
5. Event Correlation – The events from the various source are correlated and contextualized based on a set of predefined correlation rules.
6. Incident Management – Prioritization of Incident as per the predefined rules and objectives.
7. Threat Identification and Reaction – It is a process of determining threats correctly and a proactive measure obtained through. A SOC reacts either re-actively or proactive to threats.
8. Reporting – It generates Client detailed Security report

Security Operation Center Work Flow.

Components of Security Operation Center.

People < >Process < > Technology

Type of Security Operation Center Models.

• Internal SOC model
• Outsourced SOC model
• Hybrid SOC model

SOC Implementation phases

Difference Between Log Event and Incident

So let’s understand where we can find logs that we need to collect for the Security Operation center and how to build use cases for detection of an incident.

Window Logs and location

Windows Event log audit configuration is recorded based on the registry key.

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eve ntLog

In windows, machine event log are stored in system32\winevt\logs as shown below.

In windows, machine events is stored in Event viewer which you can open through RUN “eventvwr”.

Linux Log and Location

Mac Log and Location

Mac Log and Location

Firewall Log and Location

Web server Log and Location

Based on these log we can create a centralized log mechanism and able to identify potential incident. lets talk about some case studies using SPLUNK.

USE CASES of Operational Intelligence using SPLUNK

CASE STUDY 1

Solution:

CASE STUDY 2

Solution:

CASE STUDY 3

Solution:

USE CASES for threats using SPLUNK

XSS Attack detection using Splunk

Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. It allows an attacker to circumvent the same origin policy, which is designed to segregate different websites from each other.

Cross-site scripting vulnerabilities normally allow an attacker to masquerade as a victim user, to carry out any actions that the user is able to perform, and to access any of the user’s data. If the victim user has privileged access within the application, then the attacker might be able to gain full control over all of the application’s functionality and data.

SQL Attack Detection using SPLUNK

SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure or perform a denial-of-service attack.

Directory Traversal Detection using SPLUNK

Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. In some cases, an attacker might be able to write to arbitrary files on the server, allowing them to modify application data or behavior, and ultimately take full control of the server.

Likewise, we can detect all the threats using SPLUNK. Thanks for your time I hope you all have a seriously awesome week. This is just an overview let me know if you need more guidance for the same. 

You can take a completeSOC Analyst Trainingfor Level 1 and Level 2 Analyst