Abstract:
The paper considers an approach to the design of a system for data and security events collecting, storing and processing based on Elastic Stack tools. The tasks of monitoring and incident management are analyzed; architectural solutions for monitoring systems are studied; requirements to such systems are defined; and the architecture of systems for data and security events collecting, storing and processing is suggested. The developed software prototype of such system is described, and the results of experiments are specified.
Keywords:
security information and event management; Big Data; SIEM systems; Elastic Stack; Elasticsearch; Logstash; Kibana.
This research is supported by RSF (project № 15-11-30029).
Bibliographic databases:
Document Type:
Article
UDC:
004.056.53
Language: Russian
Citation:
I. V. Kotenko, A. A. Kuleshov, I. A. Ushakov, “A system for collecting, storing and processing security information and events based on Elastic Stack tools”, Tr. SPIIRAN, 54 (2017), 5–34
\Bibitem{KotKulUsh17}
\by I.~V.~Kotenko, A.~A.~Kuleshov, I.~A.~Ushakov
\paper A system for collecting, storing and processing security information and events based on Elastic Stack tools
\jour Tr. SPIIRAN
\yr 2017
\vol 54
\pages 5--34
\mathnet{http://mi.mathnet.ru/trspy964}
\crossref{https://doi.org/10.15622/sp.54.1}
\elib{https://elibrary.ru/item.asp?id=30282018}
Linking options:
https://www.mathnet.ru/eng/trspy964
https://www.mathnet.ru/eng/trspy/v54/p5
This publication is cited in the following 6 articles:
V. M. Krundyshev, G. A. Markov, I. Yu. Zhukov, “Mathematical Model of Information Security Event Management Using a Markov Chain in Industrial Systems”, Aut. Control Comp. Sci., 58:8 (2024), 1132
Igor Kotenko, Andrey Krasov, Igor Ushakov, Konstantin Izrailov, “An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database”, JSAN, 10:2 (2021), 25
Viktoria Konovalova, Nikita Kazakov, Hamza Mohammed Ridha Al-Khafaji, Maxim Kovtsur, Anton Kistruga, The 5th International Conference on Future Networks & Distributed Systems, 2021, 581
Anastasiia O. Khlobystova, Maxim V. Abramov, Tatiana V. Tulupyeva, 2020 XXIII International Conference on Soft Computing and Measurements (SCM), 2020, 37
I.V. Kotenko, N.A. Komashinskiy, I.B. Saenko, A.V. Bashmakov, “Methods and tools of parallel event processing for creating new generation of security monitoring systems”, I&C, 5 (2020), 107
Andrey Krasov, Lidia Vitkova, Igor Pestov, 2019 International Russian Automation Conference (RusAutoCon), 2019, 1
Citation in format AMSBIB
Contact us: