Description

SIEM-SOC

Project Title
SIEM/SOC
General Description and scope
Correlation monitoring system for information security events
SIEM / SOC system
The purpose of the system is to build correlations of information security events on the network, and real-time alerting to the relevant parties. The algorithms of a learning machine and artificial intelligence will be used.
The system will be based on a central management server that will receive the various alerts that will come from the various agents that will be installed on the various environments (servers, end stations, FW,)
The system will look for correlations from the various indications in accordance with the correlations that will be written by the user manually.
If a correlation is found in the system, then the server will send an alert via email to the relevant parties.
The server will also display graphs and reports for managers which will describe the state of the network, which events were detected in different periods, and on which stations or servers.
Student Requirements
List expectations from students, such as:
- Teamwork
- Full attendance in weekly meetings
- High motivation
- Independent learning
- Personal responsibility
Development Tools
- Python or Node.js for the central management server and correlation engine
- Python ML libraries (scikit-learn / TensorFlow) for anomaly detection
- ELK Stack (Elasticsearch, Logstash, Kibana) for log correlation, alerting and dashboards
- SMTP integration for email alerts
- MySQL or PostgreSQL for storing events and reports
- Docker, GitHub

Deliverables
List all required deliverables:
- Specification document
- YouTube video
- Poster
- Presentation
- GitHub link to the code

Additional Notes
• Each project team may include up to 4 students.
• Please include your contact details at the end of the document for student inquiries:
   - Roi Zimon
   - Roiz@hit.ac.il

For any questions, you may also contact: Shirany.hit@gmail.com
SIEM-SOC

Cyber

Description

Emphasis in project execution

The project is has cooperation with the industry and combines meeting deadlines while being creative and focused on the task
