SIEMulate: Automating Cybersecurity Attack Simulations for SIEM Validation
Guardado en:
| Udgivet i: | ProQuest Dissertations and Theses (2025) |
|---|---|
| Hovedforfatter: | |
| Udgivet: |
ProQuest Dissertations & Theses
|
| Fag: | |
| Online adgang: | Citation/Abstract Full Text - PDF |
| Tags: |
Ingen Tags, Vær først til at tagge denne postø!
|
MARC
| LEADER | 00000nab a2200000uu 4500 | ||
|---|---|---|---|
| 001 | 3236339319 | ||
| 003 | UK-CbPIL | ||
| 020 | |a 9798290927183 | ||
| 035 | |a 3236339319 | ||
| 045 | 2 | |b d20250101 |b d20251231 | |
| 084 | |a 66569 |2 nlm | ||
| 100 | 1 | |a Webster, Radhe | |
| 245 | 1 | |a SIEMulate: Automating Cybersecurity Attack Simulations for SIEM Validation | |
| 260 | |b ProQuest Dissertations & Theses |c 2025 | ||
| 513 | |a Dissertation/Thesis | ||
| 520 | 3 | |a Security Information and Event Management (SIEM) systems are the analytic core of cybersecurity operations, yet their effectiveness depends on the reliability of their detection rules. Many Security Operations Centers (SOCs) do not perform ongoing validation of these rules, which can result in undetected adversarial activity and an inflated perception of coverage. This praxis introduces SIEMulate, an automated framework that validates SIEM detection rules by executing adversary emulation tests, collecting system telemetry, and comparing observed outcomes against expected detections using a Continuous Integration / Continuous Delivery (CI/CD) pipeline. The implementation incorporates Atomic Red Team for simulated adversary tests, Sysmon for generating enhanced telemetry, the Splunk threat research detection library, and Splunk as the SIEM. The validation process runs within an automated pipeline that verifies log generation, maps events to MITRE ATT&CK techniques, and evaluates whether the detection rules matched the simulated adversary activity. Praxis results demonstrate the significant reduction in validation times that are achievable with automation. The validation pipeline averaged 26 seconds to complete across all 410 execution attempts (41.5 seconds for the 180 runs that fully completed all stages of the pipeline). Additionally, it provided greater context on why detections may fail, enabling detection engineers to focus on fixing the problem rather than on identifying the problem. The praxis also evaluated MITRE ATT&CK mapping as a measure of the completeness of an organization’s detection posture and found that while it may be a useful organizational framework, it is not a reliable proxy for effective detection. | |
| 653 | |a Computer engineering | ||
| 653 | |a Computer science | ||
| 653 | |a Information science | ||
| 773 | 0 | |t ProQuest Dissertations and Theses |g (2025) | |
| 786 | 0 | |d ProQuest |t ProQuest Dissertations & Theses Global | |
| 856 | 4 | 1 | |3 Citation/Abstract |u https://www.proquest.com/docview/3236339319/abstract/embedded/7BTGNMKEMPT1V9Z2?source=fedsrch |
| 856 | 4 | 0 | |3 Full Text - PDF |u https://www.proquest.com/docview/3236339319/fulltextPDF/embedded/7BTGNMKEMPT1V9Z2?source=fedsrch |