Implementasi Sistem Manajemen Log untuk Penanggulangan Serangan Server dengan SIEM - Putra, Willy Permana; Burjulius, Renol; Al Hilmi, Muhammad Anis; Sumarudin, A. (IKRA-ITH Informatika : Jurnal Komputer dan Informatika, 2024)
In the current digital era, information security has become a primary focus for organizations worldwide. Rapid technological advancements have brought significant benefits but also introduced increasingly sophisticated cyber threats and attacks. One approach to addressing these challenges is through Security Information and Event Management (SIEM). SIEM integrates Security Information Management (SIM) and Security Event Management (SEM) to collect, analyze, and report security data from various network sources, enabling more effective detection, response, and management of security incidents. This study focuses on handling server attacks using Wazuh SIEM as an early warning system. The methodology involves setting up a network topology to detect Distributed Denial of Service (DDoS) attacks using SIEM, collecting and analyzing log data, correlating data to identify threats, and responding to detected threats. The results indicate that SIEM is crucial in modern cybersecurity, providing real-time threat detection and response capabilities. The system successfully detected and blocked 42 attacks during the trial. In conclusion, SIEM offers greater security visibility and control, enabling organizations to detect and respond to complex security threats efficiently and effectively. Modern SIEM systems, equipped with advanced analytics and machine learning, can identify anomaly patterns and new threats, thus strengthening an organization’s cybersecurity defenses.