An Incident Management System Design to Protect Critical Infrastructures from Cyber Attacks

Nowadays, Security Information and Event Management (SIEM) is very important in software. SIEM stores and monitors events in software and unauthorized access to logs can prompt different security threats such as information leakage and violation of confidentiality. In this paper, a novel method is suggested for secured and integrated access control in the SIEM. First, the key points where the SIEM accesses the information within the software is specified and integrated policies for access control are developed in them. Accordingly, the threats entered into the access control module embedded in this system are carefully detected. By applying the proposed method, it is possible to provide the secured and integrated access control module for SIEM as well as the security of the access control module significantly increases in these systems. The method is implemented in the three stages of the requirements analysis for the establishment of a secure SIEM system, secure architectural design, and secure coding. The access control module is designed to create a secured SIEM and the test tool module is designed for evaluating the access control module vulnerabilities. Also, to evaluate the proposed method, the dataset is considered with ten thousand records, and the accuracy is calculated. The outcomes show the accuracy of the proposed method is significantly improved. The results of this paper can be used for designing an integrated and secured access control system in SIEM systems.

The increasing migration of enterprise operations to Amazon Web Services (AWS) has amplified the need for robust, scalable, and intelligent cybersecurity solutions. Security Information and Event Management (SIEM) systems have become vital for detecting threats, correlating logs, and maintaining compliance in cloud environments. This systematic review explores the integration of SIEM tools within AWS-based infrastructures, focusing on their effectiveness in threat detection and log correlation. It examines leading SIEM solutions such as Splunk, IBM QRadar, Sumo Logic, and AWS-native services like Amazon GuardDuty, AWS CloudTrail, and AWS Security Hub. Emphasis is placed on key integration approaches, including API-based ingestion, agentless data capture, and real-time event streaming through AWS services like Kinesis and S3. The review critically analyzes studies published between 2018 and 2023, highlighting trends in the automation of log management, enrichment of security alerts through machine learning, and orchestration via Security Orchestration, Automation, and Response (SOAR) platforms. Challenges such as data normalization, scalability limitations, cross-service visibility, and compliance adherence in multi-account AWS architectures are discussed. The findings indicate that SIEM integration enhances threat detection efficiency by enabling proactive anomaly detection, facilitating rapid incident response, and improving forensic investigation capabilities. However, the review identifies gaps, particularly in cost optimization, handling high-velocity log streams, and adapting traditional SIEM models to dynamic, serverless AWS architectures. Best practices for successful SIEM deployment include leveraging AWS-native integrations, prioritizing event prioritization algorithms, applying continuous tuning, and aligning with security frameworks like NIST and CIS AWS Foundations Benchmark. Future research directions propose the development of AI-driven adaptive SIEM systems tailored for cloud-native environments, advanced correlation engines for serverless and containerized workloads, and strategies to optimize licensing and resource utilization. This systematic review provides cybersecurity practitioners, cloud architects, and researchers with a comprehensive understanding of SIEM integration complexities and evolving practices in AWS infrastructures, ultimately contributing to improved cloud security postures and operational resilience in the face of sophisticated cyber threats.

The topic of cybersecurity is becoming increasingly important as the number of cyberattacks continues to grow; it is no longer just a matter of protecting, but rather of detecting cyberattacks at an early stage and responding accordingly.Detecting cyberattacks in organisations is an increasingly difficult task, since the ability of malware to hide from Anti-Virus systems has massively improved.Therefore, more sophisticated security measures are required, to protect complex information systems from cyberthreats.One of the state-of-the-art solutions is a Security Information and Event Management (SIEM) system, which collects all security related information and events on a central location.Thus, it is possible to correlate and better analyse security-related events, detect, and defend sophisticated threats.The deployment of a SIEM system (SIEMS) is a process where all devices in the network need to be registered and integrated.There is no generic model for the evaluation, deployment, and operation of a sufficient SIEMS that can be applied independently of the dedicated vendor.Usually, vendors provide deployment guides for their SIEMS; however, these are product-specific and not scientifically evaluated.Applying Design Science as methodological approach, the goal of this research was to develop and scientifically validate a generic model called EDO4SIEM for the vendor-neutral evaluation, deployment, and operation of a SIEMS in organisations.As desire for future research, the model should be applied in various organisations to confirm its applicability and to further develop it.

Within today’s organizations, a Security Information and Event Management (SIEM) system is the centralized repository expected to aggregate all security-relevant data. While the primary purpose of SIEM solutions has been regulatory compliance, more and more organizations recognize the value of these systems for threat detection due to their holistic view of the entire enterprise. Today’s mature Security Operation Centers dedicate several teams to threat hunting, pattern/correlation rule creation, and alert monitoring. However, traditional SIEM systems lack the capability for advanced analytics as they were designed for different purposes using technologies that are now more than a decade old. In this paper, we discuss the requirements for a next-generation SIEM system that emphasizes analytical capabilities to allow advanced data science and engineering. Next, we propose a reference architecture that can be used to design such systems. We describe our experience in implementing a next-gen SIEM with advanced analytical capabilities, both in academia and industry. Lastly, we illustrate the importance of advanced analytics within today’s SIEM with a simple yet complex use case of beaconing detection.

This research aims to implement Security Information and Event Management (SIEM) in the Kuningan University academic system. The security of information systems in the educational environment, especially in university academic systems, is becoming increasingly important considering the availability of sensitive data, such as student personal information and academic data which must be properly protected. Security threats such as cyber attacks are increasingly complex and can often be detrimental to both universities and system users. In this research, we apply SIEM as a solution to detect, prevent and respond to security threats to the Kuningan University academic system. The system development method is used with the steps of system requirements analysis, system design, system implementation, system testing, and system evaluation. The output of this research is an increase in the security level of Kuningan University's academic system. By implementing SIEM, the system is expected to be able to quickly and effectively detect potential security threats, improve response to security events, and provide reports that are useful for making decisions. Thus, it is hoped that the results of this research can make a significant contribution in improving security and data protection in the Kuningan University academic system, as well as becoming a reference for other educational institutions in maintaining increasingly complex information security defenses.

Security of information systems is a current topic. In the case of cloud environment it is even a critical factor. In large environments like the cloud computing systems, it can be difficult to maintain a comprehensive view of the safety of the individual elements. For this reason, the utilization of technology that would allow central monitoring and that would help to maintain this awareness. Such technology is precisely Security Information and Event Management (SIEM). The main objective of this paper is to analyze the possibilities and approaches of SIEM in terms of technical requirements, logic and legal framework of the Czech Republic. On the analytical basis, the framework, which is bounding the utilization of SIEM in a cloud computing environment is proposed.

PriSIEM: Enabling privacy-preserving Managed Security Services

Lost circulation is one of the important challenges in drilling operations and bears financial losses and operational risks. The prime causes of lost circulation are related to several geological parameters, especially in problem-prone formations. Herein, the approach of applying machine learning models to forecast the intensity of lost circulation using well-log data is presented in this work. It concerns a gas field in northern Iran and contains nine well logs with lost circulation incidents categorized into six intensity classes. After rigorous exploratory analysis and preprocessing of the data, seven machine learning methods are applied: Random Forest, Extra Trees, Decision Tree, XGBoost, k-Nearest Neighbors, Support Vector Machine, and Hard Voting. Random Forest, Extra Trees, and Hard Voting are the best-performing methods. These models attained the most robust results on both key performance metrics and, hence, can predict the intensity of lost circulation quite well. Models of Extra Trees and Hard Voting show very high predictive performance values. On the other hand, their limitations in some intensity classes suggest further refinement. In this regard, the ensemble methods are highly effective for managing the multivariate nature of the task. Hard Voting aggregates multiple classifiers, becoming superior to individual models like support vector machines. This paper offers new insight into integrating machine learning to well-log data toward enhancing lost circulation prediction by offering a dependable foundation for real-time drilling decision-making. These results show that the models have the potential to lower operational risks, improve drilling safety, and minimize nonproductive time; hence, they form a quantum leap in lost circulation control.

Hepatitis C is a viral infectious disease caused that affects 58 million people globally making it a public health crisis, and it is reported that 20-30% of cases develop to severe liver disease. This creates the need for data-driven based method that such as Machine learning that depends on data inputs in making accurate outputs with high precision. This study explores the use of Machine learning algorithms in optimizing the detection of hepatitis C status of patients. This research utilizes a publicly available dataset that contains 12 explanatory features and one target feature that addresses the patient’s diagnosis status. Data preprocessing techniques such as checking of missing values, assessment for possible outliers and Exploratory data analysis was carried on the dataset to improve the quality of the dataset for predictive analysis. The EDA results reviews that majority of the features had significant relationship (p-value < 0.05) with the target variable. Also, we observed the distribution of the disease diagnosis by gender reviews that females showed higher prevalence, and when we consider age, older people are more likely to contract the HCV. This result aligns with research findings from recent studies. The dataset was scaled and separated using a ratio split of 80:20 (80% of data for training). We applied SMOTE algorithm to the training data to balance the diagnosis distribution of the target variable. The model was trained using a wide parameter space using a cross-validation fold of 10 to select the best parameters. The ML models evaluated in this research include Logistic Regression, Support Vector Machine, Random Forest, XGBOOST, Decision Tree, and Extra Trees. The model performance metrics shows that XGBOOST was superior with an accuracy score of 98%, followed by Random Forest (97%), Decision Tree (94%), Extra Trees (93%), SVM (92%), and Logistic Regression (87%). The Kappa statistics for XGBOOST which was estimated as 0.8827 shows that difference between the predicted instances and the actual instances was minimal. The performance metrics of the XGBOOST was also contrast with ML algorithms trained by recent researchers in detecting HCV and it shows our model was more precise underscoring the significance of datapreprocessing, feature-scaling, SMOTE and hyperparameter tuning in predictive analysis in healthcare.

The increasing complexity and sophistication of cyber threats underscore the critical need for advanced threat detection mechanisms within Security Operations Centers (SOCs) to effectively mitigate risks and enhance cybersecurity resilience. This study enhances the capabilities of Wazuh, an open-source Security Information and Event Management (SIEM) system, by addressing its primary limitation: high false-positive rates in rule-based detection. We propose a hybrid approach that integrates machine learning (ML) techniques—specifically, Random Forest (RF) and DBSCAN—into Wazuh’s detection pipeline to improve both accuracy and operational efficiency. Experimental results show that RF achieves 97.2% accuracy, while DBSCAN yields 91.06% accuracy with a false-positive rate of 0.0821, significantly improving alert quality. Real-time deployment requirements are rigorously evaluated, with all models maintaining end-to-end processing latencies below 100 milliseconds and 95% of events processed within 500 milliseconds. Scalability testing confirms linear performance up to 500 events per second, with an average processing latency of 45 milliseconds under typical SOC workloads. This integration demonstrates a practical, resource-efficient solution for enhancing real-time threat detection in modern cybersecurity environments.

Enterprise environments generate massive volumes of security and operational logs across endpoints, networks, cloud workloads, and applications. Transforming this telemetry into timely, actionable intelligence remains a persistent challenge due to data heterogeneity, alert fatigue, and the growing speed of adversarial activity. This paper examines recent advances in enterprise log analytics and automated incident response architectures that integrate Python-driven analytics with modern Security Information and Event Management (SIEM) platforms. The study synthesizes emerging practices in scalable log ingestion, schema normalization, behavioral detection, and playbook-based response automation, emphasizing how programmable workflows reduce mean time to detect and respond. The paper first reviews architectural patterns for centralized and federated log pipelines, including streaming ingestion, enrichment, and storage optimization using columnar and search-oriented data engines. It then evaluates Python-based analytics techniques for anomaly detection, correlation, and threat hunting, covering rule engineering, statistical baselining, and machine learning models applied to high-volume event streams. Particular attention is given to integrating notebooks, APIs, and serverless functions with SIEM ecosystems to operationalize analytics and enable reproducible investigations. Next, the research analyzes automated incident response through Security Orchestration, Automation, and Response (SOAR) capabilities. Design principles for playbooks, risk scoring, and human-in-the-loop escalation are discussed alongside practical integration strategies with identity, endpoint, and ticketing systems. Case-driven examples demonstrate how Python scripts can orchestrate containment, enrichment, and remediation tasks while preserving auditability and governance. Findings highlight measurable improvements in detection fidelity, analyst productivity, and operational resilience when organizations adopt code-centric detection engineering and automation-first response strategies. However, challenges remain in data quality, model drift, and organizational readiness. The paper concludes by outlining a reference architecture and implementation roadmap for enterprises seeking to modernize log analytics and incident response using open-source tooling and SIEM-native automation. Future work explores privacy-preserving analytics, cross-cloud telemetry fusion, and metrics for continuous validation of automated controls in regulated environments. The discussion also identifies workforce skills, governance models, and change management practices required to scale automation responsibly while maintaining transparency, compliance, and trust across distributed security operations teams. This synthesis offers practical guidance for aligning security engineering, data science, and platform operations around measurable resilience outcomes in practice.

An integrated approach to automated cyber threat response is explored in this paper, with Microsoft Sentinel's Security Information and Event Management (SIEM) capabilities being leveraged alongside Logic Apps' workflow automation within the Azure ecosystem. Efficient identification and automated mitigation of security incidents are enabled by a combination of AI-driven analytics and advanced threat-hunting capabilities, resulting in a substantial reduction of manual intervention and response times. The approach is demonstrated to contribute scientifically across three core areas: (1) a novel integration of Sentinel's SIEM with Logic Apps is proposed to streamline response workflows using automated playbooks; (2) the effectiveness of the system is assessed through multiple cyber threat scenarios, including automated account blocking and virtual machine isolation in response to identified threats; and (3) Sentinel's performance is evaluated relative to other SIEM solutions, such as Splunk and IBM QRadar, particularly in Azure-centric and hybrid environments. The potential of Microsoft Sentinel and Logic Apps to advance proactive cybersecurity defenses is underscored, while key limitations in scalability and cross-platform adaptability are also identified.

IT organizations rely on a variety of independent security monitors and data sources to develop situational awareness for detecting and responding to security incidents. In spite of the advances in Security Information and Event Management (SIEM) for handling monitoring data in production environments, computer defense still depends on many cognitive human processes. In this context, having machines doing part of the cognitive work in lieu of humans is by now a real necessity. We present our framework towards the vision of cognitive SIEM, its building components and ongoing work on the topic.

Alarm management is the process of effectively developing, deploying, operating, and maintaining alarms in industrial facilities. An alert will be activated if a process value deviates from its recommended operating value. However, it is crucial to minimize excessive alarms by designing alarms in a way that assists the operator in resolving the case that triggered it. As industrial alarm management methods, guidelines, and standards are not just applicable to industrial facilities, they may be integrated with cybersecurity threat monitoring to notify an operator of an unusual situation that requires their attention. One of the most important aspects of managing cybersecurity risk is threat monitoring. Threat monitoring solutions are unfortunately usually jeopardized by alarm flooding, which frequently happens in Security Information and Event Management (SIEM) solutions due to the unnecessary announcement of numerous logs and event data from a number of sources, including applications, network devices, firewall logs, and other sources. For security operators to monitor threats effectively and consistently, alarm management and rationalization are essential. This study proposes prioritizing cybersecurity alerts based on penetration testing findings to reduce the number of less critical risk alerts provided to security operators. In order to do this, a novel natural language processing module is introduced to map penetration testing findings to the Adversarial Tactics, Techniques, and Common Knowledge standards (MITRE ATT&CK) to facilitate interaction with SIEM. Additionally, the rationalization process will be held to accept industrial alarm rationalization standards.

The chapter considers a simulation-based approach to analysis of network resilience to botnet attacks in security information and event management (SIEM) systems, which can be applied to distributed geographic information systems (GISs). On the other hand, SIEM systems can use GIS technology for network awareness, taking into account the geographical location of hosts and network segments. To be able to protect the network against botnet attacks, it is necessary to investigate the processes occurring on all stages of the botnet lifecycle (propagation, control, and attack). The suggested approach can detect the critical nodes in the network, as well as determine and evaluate the protection mechanisms against botnet attacks. We propose the architecture of the dynamic attack simulation component (DASC) and describe its interaction with other SIEM components. The component prototype is presented and results of the implemented experiments are discussed.