Security Operation Center Simulation for Beginners

Re:Security Operation Center Simulation for Beginners by iJohnDoe on Thursday October 15, 2020 @02:18PM (#24791854)

Anyone know of a real SOC or SIEM that looks like this? Something that can be installed on-prem? Thanks.

[ Parent | on HN ]

Re:Security Operation Center Simulation for Beginners by screature2 on Thursday October 15, 2020 @04:04PM (#24793155)

Security Onion leverages ELK/Elastic stack + to aggregate and visualize output from security tools https://securityonion.net/

[ Parent | on HN ]

Re:Security Operation Center Simulation for Beginners by iJohnDoe on Thursday October 15, 2020 @06:59PM (#24795328)

Thank you.

[ Parent | on HN ]

Re:Security Operation Center Simulation for Beginners by samueladam on Thursday October 15, 2020 @03:10PM (#24792552)

Splunk 8 has a dark theme.

[ Parent | on HN ]

Re:Security Operation Center Simulation for Beginners by iJohnDoe on Thursday October 15, 2020 @03:45PM (#24792933)

I remembered Splunk being a simple log parser. I didn’t remember it as a dashboard like this. It’s been many years since I looked at it though. Time to give it another look.

[ Parent | on HN ]

Re:Security Operation Center Simulation for Beginners by samueladam on Sunday October 18, 2020 @04:20AM (#24816302)

I build SOCs where Splunk can be the SIEM and it is being very nice to work with.

It integrates an editor where you can convert query results to such visualizations. You could also integrate your custom viz made with JS libs (D3).

Entreprise Security is a Splunk paid app that provides a nice environment for SOC analysts.

Yes,you should give it a try, maybe through a docker image that will get you going quickly.

[ Parent | on HN ]