Cyber Attack Detection & Visualisation using Splunk SIEM

Today, modern businesses produce huge amounts of security logs on servers, endpoints, network devices, and web applications. Manual analysis of such logs is both time consuming and ineffective, which makes it challenging to detect any malicious activity instantly. Splunk is a popular SIEM solution that helps security analysts to collect, search, analyze and visualize machine-generated security logs for various sources to detect cyber attacks, conduct investigations, generate automated alerts, and create dashboards that provide real-time visualization of security status.

This project shows how Splunk Enterprise can be utilized to collect logs from Linux operating systems, detect multiple cyber attacks within a lab setting, and visualize attack patterns using interactive dashboards.

Splunk Architecture

Log data analysis in Splunk involves three main parts:

1. Universal Forwarder: The Splunk Universal Forwarder is a light weight software agent which runs on Windows or Linux or any other source system. It collects the log data continuously and sends it to the Splunk Indexer.

2. Indexer: Splunk Indexer received data by one or more forwarders is parsed and indexed in the indexer. Data compression and storage make the searching of data more efficient. The indexer is the key component of the Splunk system because it makes the huge amount of security logs searchable.

3. Search Head: The Search Head is the interface provided by Splunk in the form of web-based application, where security analysts interact with Splunk. It performs search operations using Splunk Processing Language (SPL). The Search Head queries the indexed data and displays the output using dashboards, reports, visualizations, and alerts.

Overview

This lab explains the process of using Splunk SIEM in detecting, investigating, and visualizing different cyber attacks in a safe lab setting.

The lab setup includes the following components:

• A Kali Linux system running as victim for SSH Bruteforcing.
• Another Kali Linux system, which is responsible for launching simulated cyber attacks on the target system.
• An Ubuntu machine hosting the Splunk Enterprise system.

All the logs received from the target system are forwarded to the Splunk system, where they undergo parsing and indexing by means of SPL queries and dashboard creation.

Objectives

1. Deploying Splunk Enterprise Server on Ubuntu 24.04 server: This section explains how to install and configure Splunk Enterprise on Ubuntu (Debian system). The steps include downloading the software installer, installation, configuration of the software, and confirmation that the Splunk server works.

2. Installing Splunk Forwarder on Kali Linux: This section will explain the process of installing Splunk Universal Forwarder on Debian based Kali Linux. The process involves downloading the Forwarder, its installation, configuration of inputs and outputs, and forward Logs from /var/log/*.log to the Splunk Enterprise Server.

This section also demonstrates how to configure the Splunk Universal Forwarder on Linux systems. It includes configuring log monitoring, forwarding Linux system logs (Syslog, authentication logs, etc.), and validating successful communication with the Splunk server.

3. SSH Brute Force Attack Detection and Visualization: In this project, we illustrate the capability of Splunk SIEM in detecting and visualizing SSH brute-force attacks using the Linux authentication logs.

The above analysis involves the following steps:

• Collecting the SSH authentication logs
• Detecting multiple failed login attempts
• Identifying successful logins after brute-force attacks
• Identifying the source IPs of the attackers
• Analyzing the frequency of attacks with time
• Visualization of brute-force attacks using dashboards

4. DoS and DDoS attack Detection and Visualization: In this project, it is shown how Splunk SIEM could be used to discover and analyze DoS/DDoS attacks based on the network and systems' logs.

The discovery process involves:

• Collection of attack traffic logs
• Discovery of abnormally high spikes in the network traffic
• Discovery of high requests volume
• Analysis of source IP address that cause the attack
• Tracking attacked services and destination ports

Visualization View

Brute Force Attack visualization

DoS & DDoS Attack visualization

Special Tribute to Totan Banik Dada and Bijoy Chandra Karmakar Dada and whole Lean Sigma IT Solutions team to guide me to learn SIEM solutions and teach me Security Operations Hands on.