International Research Journal of Engineering and Technology (IRJET)
e-ISSN: 2395-0056
Volume: 12 Issue: 04 | Apr 2025
p-ISSN: 2395-0072
www.irjet.net
Monitor and Mitigate Cyberattacks with SIEM Sameer Pathan1, Sumedh Vartak2, Yash Zagade3, Prof. Bhavesh Panchal4 123Department of Computer Engineering, Rajiv Gandhi Institute of Technology, Mumbai
4Assistant Professor, Department of Computer Engineering, Rajiv Gandhi Institute of Technology, Mumbai
---------------------------------------------------------------------***--------------------------------------------------------------------The Damn Vulnerable Web Application (DVWA) is used to ABSTRACT - As more and more common and
simulate real world vulnerabilities. The deliberately insecure web application within the library allows the safe testing of common attack techniques, including SQL injection and Cross Site Scripting attacks. Host DVWA to the system so that it has something to monitor, and see live implications of attacks.
sophisticated cyber-attacks happen, you should have a strong defence system in place to detect and respond to such threats in a quick manner. The project attempts to create a Security Operations Center (SOC) setup that is powered by a Security Information and Event Management (SIEM) system to monitor as well detect cyber threats in real time. Second, we built a simulated working environment with VirtualBox, and open-source tools like Wazuh, Suricata, ModSecurity and DVWA (Damn Vulnerable Web Application) were installed and configured. It includes functioning as the central SIEM to collect and analyze data from different sources and reveals suspicious activity. We had then simulated common attacks such as Denial of Service (DoS), file tampering and some web-based exploits, and observed how the system detects and react to them. This hands-on setup does more than show how different security layers work together, but how important it is to have real time monitoring, log analysis and automated response security for protecting systems from such modern cyber threats.
We also add ModSecurity, a Web Application Firewall, to the setup in order to help defend against web-based threats. ModSecurity will help to block malicious traffic coming in before it reaches DVWA with the OWASP Core Rule Set enabled. So, in turning to protect their users and their data, this is a strong first line of defence against attacks towards the web application. Suricata is deployed on the network level as intrusion detection system (IDS). This Traffic monitoring helps detect abnormal pattern such as scan, DDoS attempts, unauthorized access attempts or any other on the network. It also has well developed deep packet inspection capabilities that allow it to be useful identifying threats early on in the attack chain.
Key Words: Cybersecurity, Virtualized SOC, SIEM, Wazuh, Denial Of Service (DOS), File Integrity Monitoring (FIM), Suricata.
Another important layer that we have added as part of Wazuh’s built in sys-check feature is File Integrity Monitoring. It records any changes made to sensitive files or directories—particularly in the DVWA environment—and hence any unauthorized modifications can be captured straight away.
1. INTRODUCTION In today’s cyber aware world, the cyber threats have reached new levels, and they are both frequent and sophisticated such that they could put lives and companies in grave danger. Attackers are always depriving new ways to exploit the system vulnerabilities, from simple phishing scams to complex network intrusions. The growing threat landscape makes a centralized system that allow monitoring, detecting, and responding to suspicious activities in real time is practically a must.
With the Active Response features of Wazuh set, finally, we can set certain Active Response features to take some action automatically in the event those threats are identified. Consider, for example, when Wazuh detects a brute force attack or a DoS pattern and it can temporarily block an attacker’s IP address by updating the firewall rules to give the administrator time to investigate and react. All together, these tools create a multi layered, lightweight security environment as a proof of concept for how a modern SOC can be build using open-source technologies. Such setup provides a clear and hands on understanding of activities to detect and counter cyber threats ranging from host to the whole network. By having this setup, one will have a hands-on idea about how to detect and mitigate cyber threats.
The idea of this project is to design and build a Security Operations Centre (SOC) utilizing the Security Information and Event Management (SIEM) approach to showcase the ways in the identification and mitigation of electronic threats. Wazuh is the heart of the system; it’s a powerful open source SIEM tool capable of collecting and analysing logs from many sources to detect potential threats. In variational environment, Wazuh is deployed as the central brain of the security setup with all other components working as necessary functionality.
© 2025, IRJET
|
Impact Factor value: 8.315
|
ISO 9001:2008 Certified Journal
|
Page 814