Alarm Rationalization for Cybersecurity Monitoring

Nowadays, Security Information and Event Management (SIEM) is very important in software. SIEM stores and monitors events in software and unauthorized access to logs can prompt different security threats such as information leakage and violation of confidentiality. In this paper, a novel method is suggested for secured and integrated access control in the SIEM. First, the key points where the SIEM accesses the information within the software is specified and integrated policies for access control are developed in them. Accordingly, the threats entered into the access control module embedded in this system are carefully detected. By applying the proposed method, it is possible to provide the secured and integrated access control module for SIEM as well as the security of the access control module significantly increases in these systems. The method is implemented in the three stages of the requirements analysis for the establishment of a secure SIEM system, secure architectural design, and secure coding. The access control module is designed to create a secured SIEM and the test tool module is designed for evaluating the access control module vulnerabilities. Also, to evaluate the proposed method, the dataset is considered with ten thousand records, and the accuracy is calculated. The outcomes show the accuracy of the proposed method is significantly improved. The results of this paper can be used for designing an integrated and secured access control system in SIEM systems.

The increasing migration of enterprise operations to Amazon Web Services (AWS) has amplified the need for robust, scalable, and intelligent cybersecurity solutions. Security Information and Event Management (SIEM) systems have become vital for detecting threats, correlating logs, and maintaining compliance in cloud environments. This systematic review explores the integration of SIEM tools within AWS-based infrastructures, focusing on their effectiveness in threat detection and log correlation. It examines leading SIEM solutions such as Splunk, IBM QRadar, Sumo Logic, and AWS-native services like Amazon GuardDuty, AWS CloudTrail, and AWS Security Hub. Emphasis is placed on key integration approaches, including API-based ingestion, agentless data capture, and real-time event streaming through AWS services like Kinesis and S3. The review critically analyzes studies published between 2018 and 2023, highlighting trends in the automation of log management, enrichment of security alerts through machine learning, and orchestration via Security Orchestration, Automation, and Response (SOAR) platforms. Challenges such as data normalization, scalability limitations, cross-service visibility, and compliance adherence in multi-account AWS architectures are discussed. The findings indicate that SIEM integration enhances threat detection efficiency by enabling proactive anomaly detection, facilitating rapid incident response, and improving forensic investigation capabilities. However, the review identifies gaps, particularly in cost optimization, handling high-velocity log streams, and adapting traditional SIEM models to dynamic, serverless AWS architectures. Best practices for successful SIEM deployment include leveraging AWS-native integrations, prioritizing event prioritization algorithms, applying continuous tuning, and aligning with security frameworks like NIST and CIS AWS Foundations Benchmark. Future research directions propose the development of AI-driven adaptive SIEM systems tailored for cloud-native environments, advanced correlation engines for serverless and containerized workloads, and strategies to optimize licensing and resource utilization. This systematic review provides cybersecurity practitioners, cloud architects, and researchers with a comprehensive understanding of SIEM integration complexities and evolving practices in AWS infrastructures, ultimately contributing to improved cloud security postures and operational resilience in the face of sophisticated cyber threats.

The topic of cybersecurity is becoming increasingly important as the number of cyberattacks continues to grow; it is no longer just a matter of protecting, but rather of detecting cyberattacks at an early stage and responding accordingly.Detecting cyberattacks in organisations is an increasingly difficult task, since the ability of malware to hide from Anti-Virus systems has massively improved.Therefore, more sophisticated security measures are required, to protect complex information systems from cyberthreats.One of the state-of-the-art solutions is a Security Information and Event Management (SIEM) system, which collects all security related information and events on a central location.Thus, it is possible to correlate and better analyse security-related events, detect, and defend sophisticated threats.The deployment of a SIEM system (SIEMS) is a process where all devices in the network need to be registered and integrated.There is no generic model for the evaluation, deployment, and operation of a sufficient SIEMS that can be applied independently of the dedicated vendor.Usually, vendors provide deployment guides for their SIEMS; however, these are product-specific and not scientifically evaluated.Applying Design Science as methodological approach, the goal of this research was to develop and scientifically validate a generic model called EDO4SIEM for the vendor-neutral evaluation, deployment, and operation of a SIEMS in organisations.As desire for future research, the model should be applied in various organisations to confirm its applicability and to further develop it.

Within today’s organizations, a Security Information and Event Management (SIEM) system is the centralized repository expected to aggregate all security-relevant data. While the primary purpose of SIEM solutions has been regulatory compliance, more and more organizations recognize the value of these systems for threat detection due to their holistic view of the entire enterprise. Today’s mature Security Operation Centers dedicate several teams to threat hunting, pattern/correlation rule creation, and alert monitoring. However, traditional SIEM systems lack the capability for advanced analytics as they were designed for different purposes using technologies that are now more than a decade old. In this paper, we discuss the requirements for a next-generation SIEM system that emphasizes analytical capabilities to allow advanced data science and engineering. Next, we propose a reference architecture that can be used to design such systems. We describe our experience in implementing a next-gen SIEM with advanced analytical capabilities, both in academia and industry. Lastly, we illustrate the importance of advanced analytics within today’s SIEM with a simple yet complex use case of beaconing detection.

Security of information systems is a current topic. In the case of cloud environment it is even a critical factor. In large environments like the cloud computing systems, it can be difficult to maintain a comprehensive view of the safety of the individual elements. For this reason, the utilization of technology that would allow central monitoring and that would help to maintain this awareness. Such technology is precisely Security Information and Event Management (SIEM). The main objective of this paper is to analyze the possibilities and approaches of SIEM in terms of technical requirements, logic and legal framework of the Czech Republic. On the analytical basis, the framework, which is bounding the utilization of SIEM in a cloud computing environment is proposed.

The fast-changing digital environment, increasingly targeted by cyber-attacks, demands a dynamic approach to safeguarding organizational assets and providing effective IT service desk support. In this paper, it is stated that the application of Artificial Intelligence (AI), Security Information and Event Management (SIEM) tools, Multi Factor Authentication (MFA) and incident response plans can be interlinked to assist in enhancing cybersecurity, along with the IT service desk efficiency. We examine the application of AI: to automate threat detection and response through automation of SIEM in the form of AI-driven SIEM automation, to attack real-time Security Monitoring with SIEM tools and as one of the key dimensions of ensuring the enhancement of the access control via Multi-Factor Authentication (MFA). In addition, the paper also explains the role that a joint incident response mechanism has in alleviating the effects of breaches and enhancing the organizational resilience of large organizations. Implementing these technologies will allow institutions to achieve more precise detection and faster response times, and less overhead, which will eventually lead to more investment in cybersecurity and IT support systems. The paper also provides a case study and implementation issues to provide a full picture of the practical implications of the integrated solutions.

In recent years, there has been a noticeable trend toward targeted threats to information security, where companies are now leveraging vulnerabilities and risks associated with widely used services in order to generate financial gain. Additionally, they implement numerous precautions and consistently carry out their tasks. One item that requires precautionary measures is the network devices utilized. Network devices in computer networks possess the capability to log events. These logs enable the identification of security events on the network and facilitate the implementation of precautionary measures. Various security measures can be implemented to handle such data. One of these measures is Security Information and Event Management (SIEM). It is a system that gathers and analyzes data from networks and security devices. SIEM is a technique employed to consolidate critical information within a cohesive structure. It allows for the correlation of events from different security devices, thereby improving the monitoring capabilities of cybersecurity operations centers. This study extensively covers the critical infrastructure-SIEM relationship, current studies, critical infrastructure, cyber security policies, and SIEM. Our system design was developed using the UNSW\_NB15 dataset, a widely recognized dataset in cybersecurity due to its comprehensive and realistic representation of cyber threats. This dataset consists of data obtained from network traffic, various attack activities, and real-life modern normal scenarios, making it particularly relevant to our study. With the studies, a total of 10 different categories were analyzed, with the category consisting of nine types of attacks, namely Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms and Normal activities. The study is divided into two as the basic structure. The first step was carried out on Google Collaboratory, and then some experimental studies were carried out in Weka. Classifications were made using several methods, including Logistic Regression (LR), Extra Trees (XT), Support Vector Machines (SVM), Random Forest (RF), and Decision Trees (DT). These methods were chosen for their proven effectiveness in similar studies. In the application developed with Google Colabratory, we achieved 98.62\% in Random Forest, 99.10\% in Decision Trees, 98.87\% in Logistic Regression, 95.13\% success in Extra Trees and 99.12\% success in Support Vector Machines. As a result of the studies and experiments carried out in Weka, we achieved 92.05\% in Random Forest, 100\% in Decision Trees, 100\% in k-Nearest Neighbours, 100\% in J48, 99.19\% in Naive-Bayes and 99.35\% in BayesNet achievements.

Enterprise environments generate massive volumes of security and operational logs across endpoints, networks, cloud workloads, and applications. Transforming this telemetry into timely, actionable intelligence remains a persistent challenge due to data heterogeneity, alert fatigue, and the growing speed of adversarial activity. This paper examines recent advances in enterprise log analytics and automated incident response architectures that integrate Python-driven analytics with modern Security Information and Event Management (SIEM) platforms. The study synthesizes emerging practices in scalable log ingestion, schema normalization, behavioral detection, and playbook-based response automation, emphasizing how programmable workflows reduce mean time to detect and respond. The paper first reviews architectural patterns for centralized and federated log pipelines, including streaming ingestion, enrichment, and storage optimization using columnar and search-oriented data engines. It then evaluates Python-based analytics techniques for anomaly detection, correlation, and threat hunting, covering rule engineering, statistical baselining, and machine learning models applied to high-volume event streams. Particular attention is given to integrating notebooks, APIs, and serverless functions with SIEM ecosystems to operationalize analytics and enable reproducible investigations. Next, the research analyzes automated incident response through Security Orchestration, Automation, and Response (SOAR) capabilities. Design principles for playbooks, risk scoring, and human-in-the-loop escalation are discussed alongside practical integration strategies with identity, endpoint, and ticketing systems. Case-driven examples demonstrate how Python scripts can orchestrate containment, enrichment, and remediation tasks while preserving auditability and governance. Findings highlight measurable improvements in detection fidelity, analyst productivity, and operational resilience when organizations adopt code-centric detection engineering and automation-first response strategies. However, challenges remain in data quality, model drift, and organizational readiness. The paper concludes by outlining a reference architecture and implementation roadmap for enterprises seeking to modernize log analytics and incident response using open-source tooling and SIEM-native automation. Future work explores privacy-preserving analytics, cross-cloud telemetry fusion, and metrics for continuous validation of automated controls in regulated environments. The discussion also identifies workforce skills, governance models, and change management practices required to scale automation responsibly while maintaining transparency, compliance, and trust across distributed security operations teams. This synthesis offers practical guidance for aligning security engineering, data science, and platform operations around measurable resilience outcomes in practice.

Contemporary security information and event management (SIEM) solutions struggle to identify critical security incidents effectively due to the overwhelming number of false alerts generated by disparate security products, which results in significant alert fatigue and hinders effective incident response. To overcome this challenge, we propose a next-generation SIEM framework that integrates security orchestration automation and response capabilities and utilizes a divide-and-conquer strategy to mitigate the impact of low-quality IDS alerts. The proposed framework leverages advanced machine learning and data visualization tools—including a cost-sensitive learning method and an event segmenting algorithm—to filter and correlate alerts plus an augmented visualization tool to expedite the triage process. The proposed framework was evaluated experimentally on a dataset collected from a real-world enterprise network, and we report highly convincing results. The alert screening scheme demonstrates significant potential for real-world security operations. We believe that our findings will contributing to the development of a next-generation SIEM system that effectively addresses alert fatigue and lays the foundation for future research in this field.

An integrated approach to automated cyber threat response is explored in this paper, with Microsoft Sentinel's Security Information and Event Management (SIEM) capabilities being leveraged alongside Logic Apps' workflow automation within the Azure ecosystem. Efficient identification and automated mitigation of security incidents are enabled by a combination of AI-driven analytics and advanced threat-hunting capabilities, resulting in a substantial reduction of manual intervention and response times. The approach is demonstrated to contribute scientifically across three core areas: (1) a novel integration of Sentinel's SIEM with Logic Apps is proposed to streamline response workflows using automated playbooks; (2) the effectiveness of the system is assessed through multiple cyber threat scenarios, including automated account blocking and virtual machine isolation in response to identified threats; and (3) Sentinel's performance is evaluated relative to other SIEM solutions, such as Splunk and IBM QRadar, particularly in Azure-centric and hybrid environments. The potential of Microsoft Sentinel and Logic Apps to advance proactive cybersecurity defenses is underscored, while key limitations in scalability and cross-platform adaptability are also identified.

PriSIEM: Enabling privacy-preserving Managed Security Services

IT organizations rely on a variety of independent security monitors and data sources to develop situational awareness for detecting and responding to security incidents. In spite of the advances in Security Information and Event Management (SIEM) for handling monitoring data in production environments, computer defense still depends on many cognitive human processes. In this context, having machines doing part of the cognitive work in lieu of humans is by now a real necessity. We present our framework towards the vision of cognitive SIEM, its building components and ongoing work on the topic.

The chapter considers a simulation-based approach to analysis of network resilience to botnet attacks in security information and event management (SIEM) systems, which can be applied to distributed geographic information systems (GISs). On the other hand, SIEM systems can use GIS technology for network awareness, taking into account the geographical location of hosts and network segments. To be able to protect the network against botnet attacks, it is necessary to investigate the processes occurring on all stages of the botnet lifecycle (propagation, control, and attack). The suggested approach can detect the critical nodes in the network, as well as determine and evaluate the protection mechanisms against botnet attacks. We propose the architecture of the dynamic attack simulation component (DASC) and describe its interaction with other SIEM components. The component prototype is presented and results of the implemented experiments are discussed.

Nowadays, organizations are resorting to Security Information and Event Management (SIEM) systems to monitor and manage their network infrastructures. SIEMs employ a data collection capability based on many sensors placed in critical points of the network, which forwards events to a core facility for processing and support different forms of analysis (e.g., report attacks in near real time, inventory management, risk assessment). In this paper, we will focus on the defense of the core facility components by presenting a new firewall design that is resilient to very harsh failure scenarios. In particular, it tolerates not only external attacks but also the intrusion of some of its components. The firewall employs a two level filtering scheme to increase performance and to allow for some flexibility on the selection of fault-tolerance mechanisms. The first filtering stage efficiently eliminates the most common forms of attacks, while the second stage supports application rules for a more sophisticated analysis of the traffic. The fault tolerance mechanisms are based on a detection and recovery approach for the first stage, while the second stage uses state machine replication and voting.

This research aims to implement Security Information and Event Management (SIEM) in the Kuningan University academic system. The security of information systems in the educational environment, especially in university academic systems, is becoming increasingly important considering the availability of sensitive data, such as student personal information and academic data which must be properly protected. Security threats such as cyber attacks are increasingly complex and can often be detrimental to both universities and system users. In this research, we apply SIEM as a solution to detect, prevent and respond to security threats to the Kuningan University academic system. The system development method is used with the steps of system requirements analysis, system design, system implementation, system testing, and system evaluation. The output of this research is an increase in the security level of Kuningan University's academic system. By implementing SIEM, the system is expected to be able to quickly and effectively detect potential security threats, improve response to security events, and provide reports that are useful for making decisions. Thus, it is hoped that the results of this research can make a significant contribution in improving security and data protection in the Kuningan University academic system, as well as becoming a reference for other educational institutions in maintaining increasingly complex information security defenses.