![](bg6.png)
By Technology: Azure, active directory, cisco, office
365, MySQL, SQL diagnostic (Solar winds, 2023).
4 ANALYSIS AND RESULTS
Domain name is important one for websites. In my
analysis shows how the threat has detected in domain
name using some SIEM tool. I’ve take a tool
(AlienVault OTX) For analysis the domain.
AlienVault OTX: First we create a OTX pulse.
Pulse provide is a summary of the threat, indicators
of compromise (IOC) it includes IP address,
Domains, Hostnames & subdomains, Emails, URL,
URI, file hashes like MD5, SHA256, PEHASH,
IMPHASH, CIDR Rules, File Paths, MYTEX name,
CVE number (Alienvault, 2023).
An AlienVault dashboard shows the realtime
visualization of malware cluster. It explain the type of
malware family and its detailed information. They are
classified in different colour like algae green and red.
The algae green is represent negative sandbox alert
and the red colour is mention by positive sandbox
alert. The visualization of malware family show the
detailed information of the family, number of count,
feature count and the alienvault have endpoint scan,
check pluse. In my case i’ve select random domain
name for analysis purpose. It show the detailed
information about the domain name, sub domain
name, and URLs Domain analysis report Figure 1.2
show the given domain details and pluses, like sub
domain, host address, ip address of the domain,
Certificate Issuer details, and hash type.
In Figure 1.3 is show the status of the Domain like
Total Request, SSL request, server Responses,
Hostname, Whitelisted URLs, Non-whitelisted
URLs, and pluses and Figure 1.4 as show the server
status of the given domain like, connection,
Encoding-type, version of the domain.
5 CONCLUSION
The needs of SIEM are higher for an organizations or
enterprises, an SIEM tools are providing various
platform-based services like cloud based SIEM and
on-premises SIEM and it has some merits and
demerits. my survey has explored how the SIEM are
performed and analyses the enterprise data, and I
mentioned AlienVault OTX tool performances. Why
we choose this particular tool because it is an open
source and it user friendly. This performance also is
pretty good and detailed.
REFERENCES
Miloslavskaya, N. (2017). Analysis of SIEM Systems and
Their Usage in Security Operations and Security
Intelligence Centers. Advances in Intelligent Systems
and Computing, 282–288. https://doi.org/10.1007/978-
3-319-63940-6_40
González-Granadillo, G.; González-Zarzosa, S.; Diaz, R.
Security Information and Event Management (SIEM):
Analysis, Trends, and Usage in Critical Infrastructures.
Sensors 2021, 21, 4759. https://doi.org/10.3390/s21144
759 (for table)
Pavlik, Jakub, et al. “Security Information and Event
Management in the Cloud Computing Infrastructure.”
2014 IEEE 15th International Symposium on
Computational Intelligence and Informatics (CINTI),
IEEE, Nov. 2014. Crossref, https://doi.org/10.1
109/cinti.2014.7028677. (background->architecture of
siem)
Eswaran, Sivaraman, et al. “A Threshold-based, Real-time
Analysis in Early Detection of Endpoint Anomalies
Using SIEM Expertise.” Network Security, vol. 2021,
no. 4, Mark Allen Group, Apr. 2021, pp. 7–16.
Crossref, https://doi.org/10.1016/s1353-4858(21)
00039-8. (real-time event response)
Majeed, Abdul, et al. “Near-miss Situation Based Visual
Analysis of SIEM Rules for Real Time Network
Security Monitoring.” Journal of Ambient Intelligence
and Humanized Computing, vol. 10, no. 4, Springer
Science and Business Media LLC, July 2018, pp. 1509–
26. Crossref, https://doi.org/10.1007/s12652-018-
0936-7. (event correlation and security data analysis)
Makkar, A., Kumar, N.: User behavior analysis-based smart
energy management for webpage ranking: Learning
automata-based solution. Sustain. Comput. Inf. Syst.
20, 174–191(2018) https://doi.org/10.1016/j.suscom.
2018.02.003.ISSN22105379 (UEBA)
Svoboda, Tomas, et al. “Behavioral Analysis of SIEM
Solutions for Energy Technology Systems.” Lecture
Notes of the Institute for Computer Sciences, Social
Informatics and Telecommunications Engineering,
Springer International Publishing, 2021, pp. 265–76.
Crossref, https://doi.org/10.1007/978-3-030-67101-
3_21. (UEBA) Internet References
Jeferson Martínez, Javier M. Durán. "Software Supply
Chain Attacks, a Threat to Global Cybersecurity:
SolarWinds’ Case Study", International Journal of
Safety and Security Engineering,2021 (intro)
Press releases (no date) Uptime Institute. Available at:
https://uptimeinstitute.com/about-ui/press-releases
(Accessed: December 31, 2022).
Marija Mladenovska Jan 9 (no date). What is a cloud siem?,
AT&T Cybersecurity. Available at: https://
cybersecurity.att.com/blogs/security-essentials/ cloud-
based-siem (Accessed: January 1, 2023).
What is Security Information and Event Management
(SIEM)? (no date) IBM. Available at:
https://www.ibm.com/topics/siem (Accessed: January
1, 2023).
AI4IoT 2023 - First International Conference on Artificial Intelligence for Internet of things (AI4IOT): Accelerating Innovation in Industry
and Consumer Electronics
632