Security Information And Event Management Research Articles

Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security

Log lines consist of static parts that characterize their structure and enable assignment of event types, and event parameters, i.e., variable parts that provide specific information on system processes, such as host and user names, IP addresses, and file operations. Many detection approaches only focus on anomalous event type occurrences, i.e., they parse log lines to derive unique event identifiers and subsequently detect anomalies in event sequences or event count vectors, but neglect variable parts of log lines entirely during analysis. This is especially problematic, when monitoring strongly structured log data that contains only a small number of distinct event types, for example, logs that consist of strict key value pairs, i.e., parameters that occur consistently throughout all log lines, such as it is case in access and audit logs. Thus, novel approaches are required, which focus on analysis of log lines' variable parts. In this paper, we propose the variable type detector (VTD), a novel unsupervised approach that autonomously analyzes variable log line parts to enable anomaly detection. It assigns data types to each variable, which also include probability distributions for discrete and continuous variables. The VTD raises an alarm if a variable's data type changes. Furthermore, it implements a robust indicator function that reduces false positives by tracking the data type history of each variable and reports only significant data type changes. Additionally, an event indicator enables event-based anomaly detection by taking into account the data types of all variables of a single event type. The evaluation conducted on open-source log data, demonstrates the effectiveness of the VTD compared to conventional anomaly detection approaches, such as time series analysis and PCA. Consequently, the VTD acts as a solution that extends the intrusion detection capabilities of security information and event management (SIEM) and integrates with modern concepts of endpoint detection and response (EDR) and extended detection and responses (XDR), while simultaneously serving as an asset for process monitoring that supports user and entity behavior analytics (UEBA).

Exploring Critical Vulnerabilities in SIEM Implementation and SOC Service Procurement: An In-Depth Analysis of High-Risk Scenarios

This research paper examines the high risks encountered while using a Security Information and Event Management (SIEM) product or acquiring Security Operations Center (SOC) services. The paper focuses on key challenges such as insufficient logging, the importance of live log retentions, scalability concerns, and the critical aspect of correlation within SIEM. It also emphasizes the significance of compliance with various standards and regulations, as well as industry best practices for effective cybersecurity incident detection, response, and management.

Implementation of Security Information and Event Management (SIEM) for Monitoring IT Assets Using Alienvault OSSIM (Case Study: Udayana University Information Resources Unit)

One way that can be done to analyze cyber security equipment is by monitoring the logs it generates. Meanwhile, to be able to analyze the logs generated from each equipment requires a long time and has a high level of difficulty. When the management of the cyber security system is not going right, it causes the failure of the cyber security system. So a defense mechanism is needed on managing the log called Security Information and Event Management (SIEM) using Alienvault OSSIM tools. Threat Monitoring or monitoring of security threats in the Cyber world, is used to analyze, evaluate, and monitor network threats and as an end point for organizations to provide evidence of security threats, such as network intrusions, data exfiltration, ransomware and other malware attacks. The limitations of the problems carried out in this study were limited to Threat Monitoring using Alienvault OSSIM. There are 6 servers at the Udayana University Information Resources Unit (USDI) that are being monitored. Monitoring was carried out for 3 months. There were 230,622 Events or events that were collected as a whole. IT assets that have the most logs during monitoring are owned by DNS Servers with a total of 200,424 Events. There are 11 Event Names and 34 event logs that are discussed. The log is packaged in the form of a report along with an explanation, of course it can assist administrators in evaluating their IT assets. There is also an email notification feature using Gmail. Overall there are no attacks that are so significant with the low risk category. Alienvault OSSIM is proven to be able to carry out monitoring processes in real time properly and can help USDI to monitor the activities of its IT assets.

Detection and utilization of new-type encrypted network traffic in distributed scenarios

Encrypted Network Traffic Classification (ENTC) is a crucial task in network management. The existing ENTC schemes usually imply two hypotheses. First, adopting a centralized processing mode. Second, the number of network traffic categories is fixed. However, it is usually unreasonable to collect all network traffic to the centralized node for processing which may cause network congestion. In addition, new traffic types emerge in endlessly, and the existing models cannot classify them. This paper studies the ENTC problem in distributed scenarios, where multiple monitoring nodes coexist, and both the existing types and new types of encrypted traffic exist at the same time. These nodes cooperate to train models, which can alleviate the challenges of limited numbers and types faced by each single node. In order to solve the proposed ENTC problem, firstly, we propose a feature extraction method in the distributed scenario. Then a detection method for new type traffic and a classification method for existing type traffic are proposed. Finally, a globally consistent automatic category labeling method and classification model updating method for new types encrypted traffic are proposed. We also take Security Information and Event Management (SIEM) as an example to discuss the managerial implications.

A Literary Review of Pattern Matching Techniques in Network Intrusion Detection

With the exponential growth in devices and services being added to networks, we are also witnessing an increase in the volume and complexity of threats, urging an increased efficiency in network intrusion detection systems which primarily rely on pattern matching to identify malicious activity on the network. In this literary review of pattern matching techniques in network intrusion detection, we explore the limitations and the research carried out in both signature-based and anomaly-based intrusion detection systems to overcome them. It focuses on the performance improvements in signature-based intrusion detection systems achieved through methodologies and technologies like regular expressions, Hyperscan, RE2, Flashtext, a generalized Aho-Corasick algorithm, usage of Bloom filters and payload sampling. It also covers the usage of machine learning techniques, including genetic algorithms, Support Vector Machines (SVM) and Improved Self-Adaptive Bayesian Algorithm (ISABA), which are used to detect anomalous behavior and identify potential threats in a network in anomaly-based network intrusion detection to assist the security analysts carry out their job functions. Additionally, this review explores the integration of the MITRE ATT&CK framework and Security Information and Event Management (SIEM) systems in network intrusion detection as this framework provides a structured and standardized approach for analyzing the tactics and techniques used by attackers to classify them, while SIEM systems enable the correlation of threat activity across multiple sources, allowing for a more comprehensive and accurate view of the network security. Overall, this literary review provides insights into the state-of-the-art techniques and frameworks used in Network Intrusion Detection based on Pattern Matching, highlighting the significant improvements in performance and detection capabilities.

SecureLog: Open-Source Security Information and Event Management (SIEM) Solution for Enhanced Threat Detection and Incident Response

Purpose of the study: As organizations face increasingly sophisticated and persistent cyber threats, the need for robust Security Information and Event Management (SIEM) solutions becomes paramount. This paper presents "SecureLog," an open-source SIEM solution designed to enhance threat detection and incident response capabilities.
 Methodology: This paper explores the architecture and components of SecureLog, detailing its data collection and log management capabilities. It examines the threat detection algorithms employed, emphasizing real-time event correlation and alerting mechanisms. The paper addresses the scalability and performance considerations associated with deploying SecureLog in large-scale environments.
 Main Findings: The findings highlight the benefits of using fuzzy logic in cyber threat intelligence and pave the way for further research and development in this promising field. The future prospects and challenges of integrating fuzzy logic with other advanced technologies such as machine learning and artificial intelligence.
 Applications of this study: SecureLog emerges as a valuable open-source SIEM solution, empowering organizations with enhanced threat detection and incident response capabilities. With its feature-rich architecture and active community support, SecureLog proves to be a reliable choice for organizations seeking to fortify their cybersecurity defences.
 Novelty/Originality of this study: The paper also includes practical use cases and case studies to demonstrate the effectiveness of SecureLog in enhancing threat detection and incident response. Security and compliance considerations, including data privacy and regulatory compliance, are examined, along with recommendations for securing the SecureLog deployment.

Converged Security and Information Management System as a Tool for Smart City Infrastructure Resilience Assessment

Current research on smart cities is primarily focused on the area of applicability of information and communication technologies. However, in the context of a multidisciplinary approach, it is also necessary to pay attention to the resilience and converged security of individual infrastructures. Converged security represents a particular security type based on a selected spectrum of certain convergent security types of, assuming the creation of a complementary whole. Considering the outputs of the analysis of security breaches manifestations, this kind of security makes it possible to detect emerging security breaches earlier (still in the symptom stage), thus providing a more efficient and targeted solution suitable for building smart city infrastructure. In its essence, the article refers to the practical application of the converged security theoretical principles presented in the publication to a functional sample, deployed and tested in practical conditions in context of selected smart city infrastructure protection and resilience. Considering the nature of the practical application, the convergence of a wider spectrum of smart security alarm systems in the resilience assessment context is defined. In the beginning, the general principles of security/safety and the need for their convergence are presented. In this context, the mathematical model called Converged Resilience Assessment (CRA) method is presented for better understanding. Subsequently, Physical Security Information Management (PSIM) and Security Information and Event Management (SIEM) systems are described as a technological concept that can be used for resilience assessment. The most beneficial part is the structural, process, and functional description of the Converged Security and Information Management System (CSIM) using the concept of smart security alarm systems converged security.

Optimization of Security Information and Event Management (SIEM) Infrastructures, and Events Correlation / Regression Analysis for Optimal Cyber Security Posture

This work integrates logical and physical security processes, and simplifies the manageability of the security infrastructure. The process increases visibility to resources, which makes it easier to prevent security incidents, and provides a platform to manage the response and recovery after an incident occur. Log collection is the heart and soul of a SIEM. Log correlation is employed to identify particular sequences of log events from devices. The comparison between network level and host level events automatically perform initial validation that would not normally be performed. It considers movement of data between systems where it would not normally accounts logging on at unusual times or from unusual places, these may not generate specific security alerts, but can be much more easily spotted and flagged by a log correlation solution that sees everything in the environment. It shows some enhancements to event log normalization and significantly improves correlation rule execution. The event monitoring algorithm and SIEM correlation rules result in false positives or false negatives. Security managers, therefore, may waste time and resources that could be used to respond to real threats and assaults if there are too many false positives. This study hereby, strikes a compromise between lowering false positive alerts and not ignoring any potential abnormalities that could indicate a cyberattack when establishing SIEM correlation rules. In order to decide which data is pertinent and which data is irrelevant in an event pipeline, this research employs the use of filters. Through this examination, it can be inferred that the conditions are advantageous for promoting investment in the growth and enhancement of this technology as an essential component of industrial control systems with security operation centers, as well as offering cyber security management for small and medium-sized enterprises (SMEs) with restricted security expertise and capabilities.

The Future of SIEM in a Machine Learning-Driven Cybersecurity Landscape

As cyber threats become increasingly sophisticatedand complex, traditional Security Information and Event Management (SIEM) systems are struggling to keep up. The integration of artificial intelligence (AI) and machine learning (ML) into SIEM tools is transforming the way organizations detect, investigate, and respond to security incidents. This paper explores the future of SIEM tools in the context of the evolving cybersecurity landscape and discusses how organizations can prepare for the adoption of ML-enabled SIEM systems.ML-enabled SIEM systems significantly enhance the capabilities of traditional SIEM tools,enabling them to more effectively detect and respond to both known andemergingthreats.Organizations must develop a robust data strategy,invest in talent,and adopt ML-enabled SIEM solutions gradually to fully take advantage ofthepotentialof these technologies.Staying up-to-date with the latest trends in ML and cybersecurity isalsocrucial for organizations to maximize the benefits of ML-enabled SIEM tools.

A Survey on Network Security Monitoring: Tools and Functionalities

Recently, cybersecurity breaches have become more common, with varying levels of impact ranging from simple to major losses of financial resources or data. The network infrastructures are the main goal of the malicious activity to compromise confidentiality, integrity, and availability (CIA) of information security. The network devices produce a large number of logs, making the handling of these logs very important because they serve to record all activities and events that take place on the network’s devices and applications to detect and prevent abnormal behaviors. Network security monitoring is a process used to monitor network devices and their traffic to detect security vulnerabilities, threats, and suspicious activities. Organizations are using network security monitoring to quickly detect and respond to cybersecurity threats. Various methods are used to protect network devices, like antivirus, firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), which typically operate independently. For that reason, attacks cannot be identified unless logs and events from different devices and applications are correlated and managed from a centralized location. Security information and event management (SIEM) addresses this issue by offering the capability to increase the level of information security and data protection through centralized log management for network devices. This paper presents a survey of network security monitoring techniques, encompassing their functionality, contents, and tools. Traditional tools, intrusion detection and prevention systems, and SIEM are some of these tools. In addition, the paper introduces SIEM as the most common and advanced security tool, highlighting its functionalities and capabilities.

Breaking Alert Fatigue: AI-Assisted SIEM Framework for Effective Incident Response

Contemporary security information and event management (SIEM) solutions struggle to identify critical security incidents effectively due to the overwhelming number of false alerts generated by disparate security products, which results in significant alert fatigue and hinders effective incident response. To overcome this challenge, we propose a next-generation SIEM framework that integrates security orchestration automation and response capabilities and utilizes a divide-and-conquer strategy to mitigate the impact of low-quality IDS alerts. The proposed framework leverages advanced machine learning and data visualization tools—including a cost-sensitive learning method and an event segmenting algorithm—to filter and correlate alerts plus an augmented visualization tool to expedite the triage process. The proposed framework was evaluated experimentally on a dataset collected from a real-world enterprise network, and we report highly convincing results. The alert screening scheme demonstrates significant potential for real-world security operations. We believe that our findings will contributing to the development of a next-generation SIEM system that effectively addresses alert fatigue and lays the foundation for future research in this field.

Implementing and evaluating a GDPR-compliant open-source SIEM solution

Security Information and Event Management (SIEM) solutions collect events from the IT infrastructure and concentrate information from the various components in a single place, allowing the detection of anomalous situations and attacks, and helping to protect confidential data. But real-world network environments may be complex and heterogeneous (e.g., in terms of devices, applications, and operating systems), and the attack surface can be vast, which makes increases the amount that a SIEM solution must collect and analyze. The General Data Protection Regulation (GDPR) has increased the level of complexity in such context, as organizations must ensure the monitoring of access to personal data and various levels of security in their infrastructure.In this work, we deal with the implementation of an open-source SIEM solution that incorporates technical measures for the protection and control of personal data, ensuring compliance with the GDPR. We identify the main functionalities and describe a solution based on the Elastic Stack and additional open-source external tools.To validate our proposals, we implemented a prototype of our solution in a real-world environment. We simulated internal and external attacks that show the solution capacity to deal in real-time with the detection of threats and incidents. We also evaluated the performance and resource consumption of personal data pseudonymization processes. Obtained results show our solution presents good performance and scalability.

Agentless Approach for Security Information and Event Management in Industrial IoT

The Internet of Things (IoT) provides ease of real-time communication in homes, industries, health care, and many other dependable and interconnected sectors. However, in recent years, smart infrastructure, including cyber-physical industries, has witnessed a severe disruption of operation due to privilege escalation, exploitation of misconfigurations, firmware hijacking, malicious node injection, botnets, and other malware infiltrations. The proposed agentless module for Wazuh security information and event management (SIEM) solution contributes to securing small- to large-scale IoT networks of industry 4.0. An agentless module is implemented by vigilantly examining the IoT device traffic without installing any agent or software on the endpoints. In the proposed research scheme, a module sniffs the network traffic of IoT devices captured from the gateway and passes it to a machine learning model for initial detection and prediction. The output of the ML model is embedded in the JSON log format and passed through the Wazuh agent to the Wazuh server where a decoder is added that decodes the network traffic logs. For event monitoring in Wazuh, industrial protocols are also thoroughly analyzed, and the feature set is determined. These features are used to write rules which are tested on the SWaT dataset, utilizing a common industrial protocol (CIP) for communication. Custom and dynamic rules are written at the Wazuh end to generate alerts to respond to any anomaly detected by the machine learning (ML) model or in the protocols used. Finally, in case of any event or an attack is detected, the alerts are fired on the Wazuh dashboard. This agentless SIEM solution has practical implications for the security of the industrial control systems of industry 4.0.

The concept of building security of the network with elements of the semiotic approach

The object of research: First, to identify and discuss the security problems of cyber-physical systems associated with the emergence of qualitatively new technologies and qualitatively new affordable artificial intelligence software. Secondly, building the concept of the security structure of a cyber-physical system based on the Zero Trust Security approach. Creation of a new secure load transfer structure based on the semiotic approach.
 Investigated problem: Information system security problems continue to cause significant costs and damage to organizations. Sustainability requires comprehensive and integrated security platforms that reach customers, whether they work at headquarters, in a branch office, or individually from random touchpoints.
 The main scientific results: the concept of a structured protection system with the Zero Trust Security approach has been developed. The structure of the semiotic analysis of the segmentation of the transmitted load on the blocks is proposed. Blocks by signs are subjected to individual analysis. According to the features, the blocks are transformed by the selected representation into an object/groups of objects. Groups for transmission in the load are tagged, have different coding severity (depth), depending on the risk assessment. Groups are transmitted through the network in different ways (paths) – VPN (different ESP), unencrypted tunnel, open access, etc.
 This solution improves the throughput of malicious load analysis prior to transmission. The performance overhead for encoding/decoding the load and encapsulating/de-encapsulating during transmission is reduced. The transmission bandwidth is increased.
 The area of practical use of the research results: businesses requiring secure access to on-premise resources and mission-critical cloud environments. Organizations using employees in distributed networks. Specialists in the deployment and analysis of the protection of cyber-physical systems.
 Innovative technological product: The semiotic security concept extends the zero-trust security model, which focuses on protecting network traffic within and between organizations. This concept uses load traffic segmentation, which combines an advanced analysis and transfer load transformation framework.
 This concept provides for integration with other cybersecurity technologies such as endpoint discovery and response (EDR) and security information and event management (SIEM) to provide a more comprehensive security solution.
 This solution improves the throughput of malicious load analysis prior to transmission. Reduced performance resources for encode/decode load and encapsulate/deencapsulate in transit.
 Scope of the innovative technological product: this concept can be applied to enterprises that already have some elements of zero trust in their corporate infrastructure, but cannot strictly control the state of the requested assets, are limited in implementing security policies for certain classes of users. This deployment model can also be applied to enterprises that use cloud services for individual business processes.
 It can be useful for researchers and administrators in the development of corporate cybersecurity plans, which uses the concepts of zero-trust and covers relationships between components, workflow planning, and access policies.

Improving cybersecurity skill development through visual programming

PurposeCybersecurity training plays a decisive role in overcoming the global shortage of cybersecurity experts and the risks this shortage poses to organizations' assets. Seeking to make the training of those experts as efficacious and efficient as possible, this study investigates the potential of visual programming languages (VPLs) for training in cyber ranges. For this matter, the VPL Blockly was integrated into an existing cyber range training to facilitate learning a code-based cybersecurity task, namely, creating code-based correlation rules for a security information and event management (SIEM) system.Design/methodology/approachTo evaluate the VPL’s effect on the cyber range training, the authors conducted a user study as a randomized controlled trial with 30 participants. In this study, the authors compared skill development of participants creating SIEM rules using Blockly (experimental group) with participants using a textual programming approach (control group) to create the rules.FindingsThis study indicates that using a VPL in a cybersecurity training can improve the participants' perceived learning experience compared to the control group while providing equally good learning outcomes.Originality/valueThe originality of this work lies in studying the effect of using a VPL to learn a code-based cybersecurity task. Investigating this effect in comparison with the conventional textual syntax through a randomized controlled trial has not been investigated yet.

V-SOC4AS: A Vehicle-SOC for Improving Automotive Security

Integrating embedded systems into next-generation vehicles is proliferating as they increase safety, efficiency, and driving comfort. These functionalities are provided by hundreds of electronic control units (ECUs) that communicate with each other using various protocols that, if not properly designed, may be vulnerable to local or remote attacks. The paper presents a vehicle-security operation center for improving automotive security (V-SOC4AS) to enhance the detection, response, and prevention of cyber-attacks in the automotive context. The goal is to monitor in real-time each subsystem of intra-vehicle communication, that is controller area network (CAN), local interconnect network (LIN), FlexRay, media oriented systems transport (MOST), and Ethernet. Therefore, to achieve this goal, security information and event management (SIEM) was used to monitor and detect malicious attacks in intra-vehicle and inter-vehicle communications: messages transmitted between vehicle ECUs; infotainment and telematics systems, which provide passengers with entertainment capabilities and information about the vehicle system; and vehicular ports, which allow vehicles to connect to diagnostic devices, upload content of various types. As a result, this allows the automation and improvement of threat detection and incident response processes. Furthermore, the V-SOC4AS allows the classification of the received message as malicious and non-malicious and acquisition of additional information about the type of attack. Thus, this reduces the detection time and provides more support for response activities. Experimental evaluation was conducted on two state-of-the-art attacks: denial of service (DoS) and fuzzing. An open-source dataset was used to simulate the vehicles. V-SOC4AS exploits security information and event management to analyze the packets sent by a vehicle using a rule-based mechanism. If the payload contains a CAN frame attack, it is notified to the SOC analysts.

Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)

The cyber security industry is rapidly adopting threat hunting as a proactive tool for early and faster detection of suspected malicious actors. In this paper, we propose a machine learning-based method, Unsupervised Hunting of Anomalous Commands (UHAC), to detect text-based anomalous commands in security information and event management (SIEM) logs that are good candidates for threat hunting. A unique feature of the proposed method is that it first creates a feature set based on the augmentation of document-term and document-character matrices. Then, an autoencoder-based detector is trained on this feature set using a custom loss function. UHAC consistently outperforms other feature sets and algorithms such as one-class support vector machine, density-based spatial clustering of applications with noise, and word-embedding based models such as word2vec. The UHAC detector identifies 84–89% of anomalies in the top 10% of the data. Findings have implications for cybersecurity analysts who perform threat hunting in SIEM logs for process auditing on endpoint devices.

Integrated Security Information and Event Management (SIEM) with Intrusion Detection System (IDS) for Live Analysis based on Machine Learning

This research builds Security Information & Event Management (SIEM) based on live analysis using machine learning on Intrusion Detection System (IDS). To implement a live analysis technique on IDS using machine learning that is integrated with SIEM, we need a combined system with many processes and services. All processes and services must be orchestrated and combined into one system to make live analysis work. Selection of the right components to be combined into a system that can build live analysis techniques on IDS using machine learning that are integrated with SIEM is needed. In addition, an open-source system for easy deployment is needed in the industrial application. Therefore, this research tries to build the system using most common open-source components for cyberattack live analysis, detection, and monitoring. This research uses a combination of Elastic (ELK) Stack, Slips, and Zeek IDS to build the system. To ensure that the components selected are correct, robust, and reliable, it is necessary to measure the performance of the combined system. Measurement focuses on measuring the performance of resource consumption (CPU and RAM). The proposed system is testing using Denial of Service (DoS) test with 344.1/sec packet. The performance testing shows Elasticsearch is the most component that uses CPU and RAM consumption with 78% of CPU usage and 2300 Mb of RAM usage. The least CPU and RAM consumption is Zeek with 3.5% CPU usage and 225 Mb RAM usage. The proposed system also worked for detecting DoS attacks on the network.

The state of development of artificial intelligence in polish industry: opinions of employees

Abstract Purpose The purpose of the article is to show how employees of industrial organizations perceive the development of artificial intelligence (AI) within them and to gather their opinions on what AI solutions are most commonly used in Polish industry. The literature review pointed to the lack of knowledge on how employees of Polish industrial companies perceive the development of AI in their respective companies and what AI solutions they already use. Design/methodology/approach Literature review and surveys were used to collect the data. The study was carried out using a survey questionnaire. The sample was taken with a specific aim in mind: first, 30 entities were selected for that purpose, while in the second stage the employees (managers and specialists) were chosen from among those. Findings In most cases, employees are not afraid of losing their jobs due to the development of AI systems in their industries. They are positive about the use of solutions that include AI elements. In the opinion of the vast majority of respondents, modern technologies, including AI, help them in their work and facilitate it. Most popular current industrial applications are: robotic process automation technologies, Cognex cameras using neural networks, machine-learning and data technologies, distributed control systems (DSCs), enterprise resource planning (ERP)) systems, and security information and event management (SIEM) systems. Practical implication-Results of this research can be useful for developing programs aimed at reducing the fear and anxiety associated with the ongoing Industrial Revolution. Originality/value The presented research results are the only ones that show the opinions of employees regarding artificial intelligence in Polish organizations.

Open source SIEM solutions for an enterprise

PurposeThe security of applications, systems and networks has always been the source of great concern for both enterprises and common users. Different security tools like intrusion detection system/intrusion prevention system and firewalls are available that provide preventive security to the enterprise networks. However, security information and event management (SIEM) systems use these tools in combination to collect events from diverse data sources across the network. SIEM is a proactive tool that processes the events to present a unified security view of the whole network at one location. SIEM system has, therefore, become an essential component of an enterprise network security architecture. However, from various options available, the selection of a suitable and cost-effective open source SIEM solution that can effectively meet most of the security requirements of small-to-medium-sized enterprises (SMEs) is not simple because of the lack of strong analysis.Design/methodology/approachIn this work, the authors first review the security challenges faced by different SME sectors and then consider a comprehensive comparative analysis of the capabilities of well-known open source SIEM solutions. Based on this, the authors provide requirements based recommendations of open source SIEM solutions for SMEs. This paper aims to provide a valuable resource that can be referred to by SMEs for the selection of a SIEM system best suited to their organization’s security posture.FindingsSecurity requirements of SMEs vary according to their network infrastructure; therefore, every open source SIEM solution would not be suitable for an SME. Selection of a SIEM solution from available open source solutions based upon the security requirements of an SME network is a critical task. Therefore, in this work, a meaningful insight for the selection of an appropriate SIEM solution for SMEs is provided.Originality/valueMajor contribution of this work is the mapping of the security requirements of the SME sectors under consideration, against the open source SIEM options to provide meaningful insight for SMEs in the selection of an appropriate solution.