The document provides an overview of Security Information and Event Management (SIEM) and its importance in cybersecurity, outlining the roles of red teams and blue teams in managing security threats. It describes various security standards organizations can adopt and emphasizes the benefits of using SIEM tools, such as real-time threat detection and regulatory compliance. The document also introduces the Wazuh SIEM tool, detailing setup instructions and additional security tools relevant to maintaining cybersecurity.

1. Introduction to
System Information and Security
Management (SIEM)
PT Flexi Integrasi Digdaya
© 2024

2. Pahrial MS ● CompTIA PenTest+ ce
● Microsoft Certified Trainer
● Certified OpenStack Administrator

3. 1. Security Team
2. Security Standard
3. What is SIEM?
4. Why use SIEM?
5. Wazuh SIEM Tool
Agenda
System Information and
Security Management (SIEM)

4. Security Team
Red Team vs Blue Team

5. Red Team
The red team is made up of offensive security experts who try to attack an organization’s
cybersecurity defenses.
Example Task:
1. Penetration testing to which help to find vulnerabilities before bad guy doing it
2. Social Engineering to manipulate others to give information and credentials
Reference: https://www.crowdstrike.com/cybersecurity-101/red-team-vs-blue-team/

6. Blue Team
The blue team defends against and responds to the red team attack or from real attack.
Example Task:
1. Create security strategy across people, tools, and technology
2. Analyze system to identify dangerous treats and give quick response accordingly
3. Hardening system to reduce attack surface
4. Incident response to recover from security breach
Reference: https://www.crowdstrike.com/cybersecurity-101/red-team-vs-blue-team/

7. Security Standard

8. Security Standards
An organization can create their own security standards or rely on existing ones:
1. Center for Internet Security Benchmarks (CIS Benchmarks)
2. National Institute of Standards and Technology Special Publication 800-53 (NIST SP 800-53)
3. Payment Card Industry Data Security Standard (PCI DSS)
4. General Data Protection Regulation (GDPR)
5. Health Insurance Portability and Accountability Act (HIPAA)

9. System Information and
Security Management (SIEM)

10. What is SIEM?
Security information and event management, SIEM for short, is a solution that helps
organizations detect, analyze, and respond to security threats before they harm business
operations.
Reference: https://www.microsoft.com/en-us/security/business/security-101/what-is-siem

11. Why use SIEM?
SIEM tools offer many benefits that can help strengthen an organization’s overall security
posture, including:
● A central view of potential threats
● Real-time threat identification and response
● Advanced threat intelligence
● Regulatory compliance auditing and reporting
● Greater transparency monitoring users, applications, and devices
Reference: https://www.microsoft.com/en-us/security/business/security-101/what-is-siem

13. About Wazuh
Wazuh delivers robust security monitoring and protection for your IT assets using its Security
Information and Event Management (SIEM) and Extended Detection and Response (XDR)
capabilities.

14. Hands-on Lab

15. Overview
1. Setup single Wazuh Server
2. Setup Wazuh Agent

16. Setup single Wazuh server
curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

17. Setup Wazuh agent
curl -o wazuh-agent-4.7.4-1.x86_64.rpm
https://packages.wazuh.com/4.x/yum/wazuh-agent-4.7.4-1.x86_64.rpm &&
sudo WAZUH_MANAGER='192.168.113.164' rpm -ihv wazuh-agent-4.7.4-1.x86_64.rpm
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

18. Access POC Environment Kemkes
https://192.168.113.164
Username: admin
Password: Z4EkQh1JZ0dAMfLrgx39NpNV1Qy?
1Qu2

19. Additional Content

20. Security Tools
● ClamAV - Multiplatform Antivirus ● Harbor - Container Registry with
Container Image Scanning

21. Security in Development - DevSecOps
- Software Composition Analysis (SCA)
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Container Image Scanning