ANALISIS PADA WAZUH SEBAGAI IMPLEMENTASI SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) TERHADAP SERANGAN MALWARE DI SISTEM OPERASI DEBIAN - Michael Aurelio Nugraha (2023)
One of the technologies that has developed rapidly until now is the Internet. The rapid development of the Internet is due to the increasingly diverse human needs as well. The rapid development of the Internet not only has a positive effect, but also a negative one. One of the negative effects of the Internet is malware attacks. In this study, analysis of malware attacks will be carried out using the concept of SIEM (Security Information and Event Management) with the aim of identifying a malware attack, analyzing the ability of SIEM to handle malware attacks, and of course finding solutions to deal with a malware attack on the system. This research will be conducted using the Windows 10 operating system, Debian 11 and also accompanied by tools such as VirusTotal and Wazuh. Wazuh is an application that is used as an implementation of the SIEM concept in this study. With the configuration between Wazuh and VirusTotal, the expected result is that an automation can be generated in the form of alerts to Wazuh and an auto remove file against the file that detected as malware.