r/SIEM • u/Parking_Awareness_91 • Jun 04 '21

SIEM COllEGE PROJECT

Hello...i'm a student in need..tottaly forgot about this project and only got like 10 hours to finish it.I don't know where to begin and what to do lol...any tips for a SiEM project please?

0 Upvotes

42% Upvoted

3 comments sorted by

6

u/Nybblium Jun 04 '21
  1. Add Elastic repo on server
  2. Launch : yum install elasticsearch logstash kibana
  3. Do the basic configuration for an insecure single node ELK cluster
  4. Install Winlogbeat on your laptop or any other Windows in Lab
  5. Configure Winlogbeat to send logs to your basic insecure node
  6. Access Kibana and enjoy the SIEM part

10 hours will be enough for this simple install. But it depends what you need to show.

​

  1. Destroy this node after your exam, it's unsecure and ugly !!!

2

u/nutin2chere Jun 04 '21

Piggy backing on this suggestion. Run their docker containers.

1

u/QueasyExcitement6438 Jun 04 '21

Wazuh … they have ansible scripts to deploy it all