An Autonomous Rule-based Mini-SOAR Platform for Log-Driven Incident Detection and Response Orchestration

Abstract

In light of the increased cyber-attacks and complex nature of IT infrastructure today, traditional monitoring systems for security have been identified to be slow and ineffective. Security Operation Centers (SOCs) still employ manual log analysis which causes delays in detecting threats and responding to them. In order to solve this problem, this paper presents the design of an Autonomous Incident Triage and Response Agent (AITRA). The proposed system is an easy and affordable solution which will be based on the idea behind SOAR technology. The proposed system seeks to automate the whole incident management lifecycle by carrying out tasks including log ingestion, event analysis, incident detection, and recommendation of responses. It receives data from sources such as system logs and authentication logs then analyzes them using rule-based analysis methods in order to detect suspicious activities such as failed login attempts, invalid access to the system by users, and escalation of privileges. A decision tree classifier machine learning algorithm is applied in order to categorize behaviors exhibited by the system and enhance detection capabilities. Detected incidents are recorded in a MariaDB database. Some of these responses include blocking IP addresses, suspending suspicious accounts, and informing the administrator. A user-friendly web-based interface that uses React and Flask technologies to help the user perform log upload, incident analysis, and receive appropriate responses is made possible by this software. Experimental evaluation results indicate that this new system makes more efficient use of time and effort than traditional methods and therefore provides better results. This is an implementation of a SOAR system in its miniature version which has the potential for further developments in future.