Proposta de implementação de um SIEM para detecção de anomalias de segurança cibernética de uma rede corporativa. Caso de estudo: Grupo Meridian32

Abstract

We live in a world digitally interconnected by the great engine of global communication that is the Internet, this interconnection has brought to the surface problems related to cybersecurity, as there is more space for action to carry out cyberattacks. The use of computer systems nowadays presupposes the need to use security mechanisms for monitoring events, as this monitoring helps organizations to have a visibility of security events and to respond actively and proactively in the scenario of an imminent or eventual cyber attack. The present work focuses on the study and presentation of a proposed solution for monitoring cybersecurity events. For the literature review of concepts inherent to cybersecurity and Information Security and Event Management solutions, the present work used the qualitative research methodology regarding the approach, which served the same to analyze the current situation of the technological ecosystem of the organization as well as the evaluation of the solutions, with a view to allowing the identification of the solution that best suits the case study. Questions were addressed to the case study for a better understanding of the current situation. This work is related to the fact that the organization does not have mechanisms for monitoring cybersecurity events and its technological park is critical for monitoring, because the main operational tasks are being performed. With the solution selected and proposed, in this context, the organization now has an overview of how the tool works and the level of influence it has thanks to the proof of concept to be implemented