Analysis of SIEM and NIDS Integration for Network Monitoring

Abstract

Network security monitoring is generally still carried out manually (dashboard-gazing), creating a time gap between the moment an incident is detected and the moment it is recognised and responded to by the administrator. This condition is aggravated by a Network Intrusion Detection System (NIDS) that works on its own, because its detection logs remain raw and unstructured, making them difficult to manage and analyse. This study proposes the integration of a Suricata-based NIDS with a Wazuh-based Security Information and Event Management (SIEM), on the grounds that Wazuh is able to manage and organise the raw Suricata logs into structured data while correlating them centrally. The integration was carried out by connecting the Suricata sensor to the Wazuh Server, so that the detection logs (eve.json), which were originally in raw JSON format, could be parsed into alerts with rule IDs and levels that are easy to analyse. Testing was conducted through the simulation of five attack scenarios (brute force, LFI, directory brute force, SQL injection, XSS) over 12 days, producing a correlation of 25,414 security logs covering all scenarios. The security readiness measurement using the KAMI Index v5.0 in the Technology Area shows that 5 of 35 criteria (14.3%) are directly fulfilled and 7 criteria (20%) are partially fulfilled. As an added value, all alerts resulting from the integration were forwarded through webhook-based Discord notifications without any delivery failure, shortening the time between a threat being detected and that threat becoming known to the administrator.

GS Cited Analysis