{"id":36204,"date":"2019-10-31T22:10:16","date_gmt":"2019-10-31T19:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti\/"},"modified":"2020-12-21T09:34:37","modified_gmt":"2020-12-21T07:34:37","slug":"5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti","title":{"rendered":"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer\" src=\"\/wp-content\/uploads\/2019\/07\/aa62f0bea220d09adad31d5ee9eaa3af.png\" style=\"display:block;margin: 0 auto;\"><\/p>\n<p><i>Mivel k\u00fcl\u00f6nb\u00f6zik egy j\u00f3 IT-biztons\u00e1gi szakember a megszokottakt\u00f3l? Nem azzal, hogy b\u00e1rmikor fejb\u0151l megmondja, h\u00e1ny \u00fczenetet k\u00fcld\u00f6tt a menedzser, Igor, tegnap a koll\u00e9gan\u0151j\u00e9nek, Mari\u00e1nak. A j\u00f3 biztons\u00e1gi szakember el\u0151re pr\u00f3b\u00e1lja \u00e9szlelni a lehets\u00e9ges szab\u00e1lys\u00e9rt\u00e9seket, \u00e9s val\u00f3s id\u0151ben nyomon k\u00f6veti \u0151ket, mindent megtesz az\u00e9rt, hogy megakad\u00e1lyozza az incidens folytat\u00e1s\u00e1t. A biztons\u00e1gi esem\u00e9nyek kezel\u00e9s\u00e9re szolg\u00e1l\u00f3 rendszerek (SIEM - Security Information and Event Management) jelent\u0151sen megk\u00f6nny\u00edtik a gyors r\u00f6gz\u00edt\u00e9s \u00e9s a b\u00e1rmilyen pr\u00f3b\u00e1lkoz\u00e1s blokkol\u00e1s\u00e1nak feladat\u00e1t.<\/i><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nHagyom\u00e1nyosan a SIEM rendszerek \u00f6tv\u00f6zik az inform\u00e1ci\u00f3biztons\u00e1gi ir\u00e1ny\u00edt\u00e1si rendszert \u00e9s a biztons\u00e1gi esem\u00e9nykezel\u0151 rendszert. A rendszerek fontos jellemz\u0151je a biztons\u00e1gi esem\u00e9nyek val\u00f3s idej\u0171 elemz\u00e9se, ami lehet\u0151v\u00e9 teszi a reakci\u00f3t a t\u00e9nyleges k\u00e1r bek\u00f6vetkezte el\u0151tt.<\/p>\n<p><b>A SIEM rendszerek f\u0151 feladatai:<\/b><\/p>\n<ul>\n<li>Adatok gy\u0171jt\u00e9se \u00e9s normaliz\u00e1l\u00e1sa<\/li>\n<li>Adatok korrel\u00e1l\u00e1sa<\/li>\n<li>\u00c9rtes\u00edt\u00e9sek<\/li>\n<li>Vizu\u00e1lis panelek<\/li>\n<li>Adat t\u00e1rol\u00e1s\u00e1nak szervez\u00e9se<\/li>\n<li>Adatok keres\u00e9se \u00e9s elemz\u00e9se<\/li>\n<li>Jelent\u00e9s<\/li>\n<\/ul>\n<h2>A SIEM rendszerek ir\u00e1nti nagy kereslet okai<\/h2>\n<p>Az ut\u00f3bbi id\u0151ben jelent\u0151sen megn\u0151ttek az inform\u00e1ci\u00f3s rendszerek elleni t\u00e1mad\u00e1sok bonyolults\u00e1ga \u00e9s koordin\u00e1lts\u00e1ga. Emellett bonyolultabb\u00e1 v\u00e1lt az alkalmazott v\u00e9dekez\u00e9si eszk\u00f6z\u00f6k \u00f6sszess\u00e9ge \u2013 h\u00e1l\u00f3zati \u00e9s hosztolt behatol\u00e1s-\u00e9szlel\u0151 rendszerek, DLP rendszerek, v\u00edruskeres\u0151 rendszerek \u00e9s t\u0171zfalak, sebezhet\u0151s\u00e9gek vizsg\u00e1l\u00f3i \u00e9s egyebek. Minden v\u00e9delmi eszk\u00f6z k\u00fcl\u00f6nb\u00f6z\u0151 r\u00e9szletess\u00e9ggel gener\u00e1l esem\u00e9nyfolyamot, \u00e9s gyakran csak k\u00fcl\u00f6nb\u00f6z\u0151 rendszerek esem\u00e9nyeinek egybevet\u00e9s\u00e9b\u0151l lehet \u00e9szlelni a t\u00e1mad\u00e1st.<\/p>\n<p>Sok minden el\u00e9rhet\u0151 a k\u00fcl\u00f6nb\u00f6z\u0151 kereskedelmi SIEM rendszerekr\u0151l, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/muk\/blog\/325330\/\">az \u00e1ll szerepel<\/a><\/noindex>, de mi egy r\u00f6vid \u00e1ttekint\u00e9st ny\u00fajtunk a teljes \u00e9rt\u00e9k\u0171, ingyenes ny\u00edlt forr\u00e1sk\u00f3d\u00fa SIEM rendszerekr\u0151l, melyek nem rendelkeznek mesters\u00e9ges korl\u00e1toz\u00e1sokkal a felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ban vagy a feldolgozott t\u00e1rolt adatmennyis\u00e9g\u00e9ben, valamint k\u00f6nnyen sk\u00e1l\u00e1zhat\u00f3k \u00e9s karbantarthat\u00f3k. Rem\u00e9lj\u00fck, ez seg\u00edt \u00e9rt\u00e9kelni az ilyen rendszerek potenci\u00e1lj\u00e1t \u00e9s meghozni a d\u00f6nt\u00e9st, hogy \u00e9rdemes-e integr\u00e1lni ezeket a megold\u00e1sokat a v\u00e1llalat \u00fczleti folyamataiba.<\/p>\n<h3>AlienVault OSSIM<\/h3>\n<p><img decoding=\"async\" alt=\"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer\" src=\"\/wp-content\/uploads\/2019\/07\/f74856a0ce3eeb7ecccc16db6ae5e076.png\" style=\"display:block;margin: 0 auto;\"><\/p>\n<p>Az AlienVault OSSIM az AlienVault USM ny\u00edlt forr\u00e1sk\u00f3d\u00fa v\u00e1ltozata, amely az egyik vezet\u0151 kereskedelmi SIEM rendszer. Az OSSIM egy keretrendszer, amely t\u00f6bb ny\u00edlt forr\u00e1sk\u00f3d\u00fa projektb\u0151l \u00e1ll, bele\u00e9rtve a Snort h\u00e1l\u00f3zati behatol\u00e1s\u00e9rz\u00e9kel\u0151 rendszert, a Nagios h\u00e1l\u00f3zat- \u00e9s csomagmonitoroz\u00f3 rendszert, az OSSEC host alap\u00fa behatol\u00e1s\u00e9rz\u00e9kel\u0151 rendszert \u00e9s az OpenVAS sebezhet\u0151s\u00e9g-ellen\u0151rz\u0151t.<\/p>\n<p>Az eszk\u00f6z\u00f6k megfigyel\u00e9s\u00e9re az AlienVault Agent szolg\u00e1l, amely syslog form\u00e1tumban k\u00fcldi a napl\u00f3kat a GELF platformra, vagy haszn\u00e1lhat\u00f3 olyan pluginokkal, amelyek integr\u00e1lj\u00e1k a harmadik f\u00e9l szolg\u00e1ltat\u00e1saival, mint p\u00e9ld\u00e1ul a Cloudflare visszafel\u00e9 proxyz\u00e1si szolg\u00e1ltat\u00e1sa vagy az Okta t\u00f6bbt\u00e9nyez\u0151s hiteles\u00edt\u00e9si rendszere.<\/p>\n<p>Az USM verzi\u00f3 a napl\u00f3k kezel\u00e9s\u00e9nek, a felh\u0151infrastrukt\u00fara monitoroz\u00e1s\u00e1nak, az automatiz\u00e1l\u00e1snak \u00e9s a friss\u00edtett fenyeget\u00e9sinform\u00e1ci\u00f3nak \u00e9s vizualiz\u00e1ci\u00f3nak a kib\u0151v\u00edtett funkcionalit\u00e1s\u00e1val k\u00fcl\u00f6nb\u00f6zik az OSSIM-t\u0151l.<\/p>\n<p><b>El\u0151ny\u00f6k<\/b><\/p>\n<ul>\n<li>Megb\u00edzhat\u00f3 ny\u00edlt forr\u00e1sk\u00f3d\u00fa projektek alapj\u00e1n \u00e9p\u00edtve;<\/li>\n<li>Nagy felhaszn\u00e1l\u00f3i \u00e9s fejleszt\u0151i k\u00f6z\u00f6ss\u00e9g.<\/li>\n<\/ul>\n<p><b>H\u00e1tr\u00e1nyok<\/b><\/p>\n<ul>\n<li>Nem t\u00e1mogatja a felh\u0151platformok monitoroz\u00e1s\u00e1t (p\u00e9ld\u00e1ul AWS vagy Azure);<\/li>\n<li>Nincs napl\u00f3kezel\u00e9s, vizualiz\u00e1ci\u00f3, automatiz\u00e1l\u00e1s \u00e9s integr\u00e1ci\u00f3 harmadik f\u00e9l szolg\u00e1ltat\u00e1saival.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ossimlabs\/ossim\"><b>Forr\u00e1s<\/b><\/a><\/noindex><\/p>\n<h3>MozDef (Mozilla V\u00e9delem Platform)<\/h3>\n<p><img decoding=\"async\" alt=\"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer\" src=\"\/wp-content\/uploads\/2019\/07\/028c667490a6b0de1f0dd6b6cc283f93.png\" style=\"display:block;margin: 0 auto;\"><\/p>\n<p>A Mozilla \u00e1ltal kifejlesztett SIEM rendszer, a MozDef, a biztons\u00e1gi incidensek kezel\u00e9s\u00e9nek automatiz\u00e1l\u00e1s\u00e1ra szolg\u00e1l. A rendszer teljesen null\u00e1r\u00f3l k\u00e9sz\u00fclt, a maxim\u00e1lis teljes\u00edtm\u00e9ny, sk\u00e1l\u00e1zhat\u00f3s\u00e1g \u00e9s megb\u00edzhat\u00f3s\u00e1g el\u00e9r\u00e9se \u00e9rdek\u00e9ben, mikroszolg\u00e1ltat\u00e1s-architekt\u00far\u00e1val \u2013 minden szolg\u00e1ltat\u00e1s egy Docker kont\u00e9nerben fut.<\/p>\n<p>Az OSSIM-hoz hasonl\u00f3an a MozDef is megb\u00edzhat\u00f3, r\u00e9gi ny\u00edlt forr\u00e1sk\u00f3d\u00fa projekteken alapul, bele\u00e9rtve a logok indexel\u00e9s\u00e9re \u00e9s keres\u00e9s\u00e9re szolg\u00e1l\u00f3 Elasticsearch modulokat, a Meteor platformot, amely rugalmas webes interf\u00e9sz l\u00e9trehoz\u00e1s\u00e1ra szolg\u00e1l, \u00e9s a Kibana plugint a vizualiz\u00e1ci\u00f3hoz \u00e9s diagramok k\u00e9sz\u00edt\u00e9s\u00e9hez.<\/p>\n<p>Az esem\u00e9nyek korrel\u00e1ci\u00f3ja \u00e9s \u00e9rtes\u00edt\u00e9s az Elasticsearch lek\u00e9rdez\u00e9se \u00fatj\u00e1n t\u00f6rt\u00e9nik, amely lehet\u0151v\u00e9 teszi a saj\u00e1t esem\u00e9nymegjelen\u00edt\u00e9si \u00e9s \u00e9rtes\u00edt\u00e9si szab\u00e1lyok meg\u00edr\u00e1s\u00e1t Python nyelven. A Mozilla szerint a MozDef napi t\u00f6bb mint 300 milli\u00f3 esem\u00e9ny kezel\u00e9s\u00e9re k\u00e9pes. A MozDef csak JSON form\u00e1tumban fogad esem\u00e9nyeket, de integr\u00e1lhat\u00f3 harmadik f\u00e9l szolg\u00e1ltat\u00e1saival.<\/p>\n<p><b>El\u0151ny\u00f6k<\/b><\/p>\n<ul>\n<li>Nem haszn\u00e1l \u00fcgyn\u00f6k\u00f6ket \u2013 a standard JSON napl\u00f3kkal m\u0171k\u00f6dik;<\/li>\n<li>K\u00f6nnyen sk\u00e1l\u00e1zhat\u00f3 a mikroszolg\u00e1ltat\u00e1s-architekt\u00fara r\u00e9v\u00e9n;<\/li>\n<li>T\u00e1mogatja a felh\u0151szolg\u00e1ltat\u00e1sok adatforr\u00e1sait, bele\u00e9rtve az AWS CloudTrail-t \u00e9s a GuardDuty-t.<\/li>\n<\/ul>\n<p><b>H\u00e1tr\u00e1nyok<\/b><\/p>\n<ul>\n<li>\u00daj \u00e9s kev\u00e9sb\u00e9 megalapozott rendszer.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mozilla\/MozDef\"><b>Forr\u00e1s<\/b><\/a><\/noindex><\/p>\n<h3>Wazuh<\/h3>\n<p><img decoding=\"async\" alt=\"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer\" src=\"\/wp-content\/uploads\/2019\/07\/b03ade4628c4cca1dd732a1e3a1f320f.png\" style=\"display:block;margin: 0 auto;\"><\/p>\n<p>A Wazuh az OSSEC, az egyik legn\u00e9pszer\u0171bb ny\u00edlt forr\u00e1sk\u00f3d\u00fa SIEM, forkjak\u00e9nt indult. Most pedig egy egyedi megold\u00e1ss\u00e1 v\u00e1lt, \u00faj funkci\u00f3kkal, jav\u00edtott hib\u00e1kkal \u00e9s optimaliz\u00e1lt architekt\u00far\u00e1val.<\/p>\n<p>A rendszer az ElasticStack (Elasticsearch, Logstash, Kibana) technol\u00f3gi\u00e1j\u00e1ra \u00e9p\u00fcl \u00e9s t\u00e1mogatja mind az \u00fcgyn\u00f6k\u00f6kre alapozott adatszerz\u00e9st, mind a rendszer napl\u00f3k fogad\u00e1s\u00e1t. Ez hat\u00e9konyan alkalmas olyan eszk\u00f6z\u00f6k monitoroz\u00e1s\u00e1ra, amelyek napl\u00f3kat gener\u00e1lnak, de nem t\u00e1mogatj\u00e1k az \u00fcgyn\u00f6k telep\u00edt\u00e9s\u00e9t \u2013 mint p\u00e9ld\u00e1ul h\u00e1l\u00f3zati eszk\u00f6z\u00f6k, nyomtat\u00f3k \u00e9s perif\u00e9ri\u00e1k.<\/p>\n<p>A Wazuh t\u00e1mogatja a megl\u00e9v\u0151 OSSEC \u00fcgyn\u00f6k\u00f6ket, \u00e9s m\u00e9g migr\u00e1ci\u00f3s \u00fatmutat\u00f3t is ny\u00fajt az OSSEC-r\u0151l a Wazuh-ra. B\u00e1r az OSSEC m\u00e9g mindig akt\u00edvan t\u00e1mogatott, a Wazuh az OSSEC folytat\u00e1s\u00e1nak tekinthet\u0151, mivel \u00faj webes fel\u00fclettel, REST API-val, sz\u00e9lesebb szab\u00e1lyk\u00e9szlettel \u00e9s sz\u00e1mos egy\u00e9b jav\u00edt\u00e1ssal b\u0151v\u00fclt.<\/p>\n<p><b>El\u0151ny\u00f6k<\/b><\/p>\n<ul>\n<li>Alapj\u00e1n \u00e9s kompatibilis a n\u00e9pszer\u0171 OSSEC SIEM-mel;<\/li>\n<li>T\u00e1mogatja a k\u00fcl\u00f6nb\u00f6z\u0151 telep\u00edt\u00e9si lehet\u0151s\u00e9geket: Docker, Puppet, Chef, Ansible;<\/li>\n<li>T\u00e1mogatja a felh\u0151szolg\u00e1ltat\u00e1sok monitoroz\u00e1s\u00e1t, bele\u00e9rtve az AWS-t \u00e9s az Azure-t;<\/li>\n<li>Kiterjedt szab\u00e1lyk\u00e9szletet tartalmaz, amely sz\u00e1mos t\u00e1mad\u00e1st\u00edpust \u00e9szlel, \u00e9s lehet\u0151v\u00e9 teszi azok \u00f6sszehangol\u00e1s\u00e1t a PCI DSS v3.1 \u00e9s a CIS k\u00f6vetelm\u00e9nyeivel.<\/li>\n<li>Integr\u00e1l\u00f3dik a Splunk napl\u00f3z\u00e1si \u00e9s elemz\u00e9si rendszer\u00e9vel az esem\u00e9nyek vizualiz\u00e1l\u00e1s\u00e1ra \u00e9s API t\u00e1mogat\u00e1s\u00e1ra.<\/li>\n<\/ul>\n<p><b>H\u00e1tr\u00e1nyok<\/b><\/p>\n<ul>\n<li>Bonyolult architekt\u00fara - teljes Elastic Stack telep\u00edt\u00e9se sz\u00fcks\u00e9ges a Wazuh szerverkomponensei mellett.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wazuh\/wazuh\"><b>Forr\u00e1s <\/b><\/a><\/noindex><\/p>\n<h3>Prelude OSS<\/h3>\n<p><img decoding=\"async\" alt=\"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer\" src=\"\/wp-content\/uploads\/2019\/07\/ff195da95996aaf9d2e268b5e1851a79.png\" style=\"display:block;margin: 0 auto;\"><\/p>\n<p>A Prelude OSS az OSSEC, Snort \u00e9s a Suricata h\u00e1l\u00f3zati \u00e9szlel\u0151 rendszer integr\u00e1ci\u00f3j\u00e1t t\u00e1mogat\u00f3, francia CS c\u00e9g \u00e1ltal fejlesztett kereskedelmi Prelude SIEM ny\u00edlt forr\u00e1sk\u00f3d\u00fa verzi\u00f3ja. Ez egy rugalmas modul\u00e1ris SIEM rendszer, amely sz\u00e1mos napl\u00f3form\u00e1tumot t\u00e1mogat.<\/p>\n<p>Minden esem\u00e9ny az IDMEF form\u00e1tumra normaliz\u00e1l\u00f3dik, ami megk\u00f6nny\u00edti az adatok cser\u00e9j\u00e9t m\u00e1s rendszerekkel. \u00c1m van egy kis h\u00e1tr\u00e1nya is \u2014 a Prelude OSS teljes\u00edtm\u00e9nye \u00e9s funkcionalit\u00e1sa jelent\u0151sen korl\u00e1tozott a kereskedelmi Prelude SIEM verzi\u00f3hoz k\u00e9pest, \u00e9s ink\u00e1bb kis projektekhez vagy a SIEM megold\u00e1sok tanulm\u00e1nyoz\u00e1s\u00e1hoz, illetve a Prelude SIEM \u00e9rt\u00e9kel\u00e9s\u00e9hez k\u00e9sz\u00fclt.<\/p>\n<p><b>El\u0151ny\u00f6k<\/b><\/p>\n<ul>\n<li>Id\u0151pr\u00f3b\u00e1lt rendszer, amelyet 1998 \u00f3ta fejlesztenek;<\/li>\n<li>T\u00e1mogatja a k\u00fcl\u00f6nb\u00f6z\u0151 napl\u00f3form\u00e1tumokat;<\/li>\n<li>Az adatokat IMDEF form\u00e1tumra normaliz\u00e1lja, \u00edgy k\u00f6nnyen \u00e1tadhat\u00f3 m\u00e1s biztons\u00e1gi rendszereknek.<\/li>\n<\/ul>\n<p><b>H\u00e1tr\u00e1nyok<\/b><\/p>\n<ul>\n<li>Funkcionalit\u00e1sa \u00e9s teljes\u00edtm\u00e9nye jelent\u0151sen korl\u00e1tozott m\u00e1s open-source SIEM rendszerekhez k\u00e9pest.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Prelude-SIEM\/Prelude-SIEM\"><b>Forr\u00e1s <\/b><\/a><\/noindex><\/p>\n<h3>Sagan<\/h3>\n<p><img decoding=\"async\" alt=\"5 ny\u00edlt forr\u00e1sk\u00f3d\u00fa biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer\" src=\"\/wp-content\/uploads\/2019\/07\/f3c92d91e49721f2a648dcbae057a8d9.png\" style=\"display:block;margin: 0 auto;\"><\/p>\n<p>A Sagan egy nagy teljes\u00edtm\u00e9ny\u0171 SIEM, amely hangs\u00falyozza a Snort-tal val\u00f3 kompatibilit\u00e1st. A Snort sz\u00e1m\u00e1ra \u00edrt szab\u00e1lyok t\u00e1mogat\u00e1sa mellett a Sagan k\u00e9pes a Snort adatb\u00e1zis\u00e1ba val\u00f3 \u00edr\u00e1sra, \u00e9s ak\u00e1r a Shuil fel\u00fclet\u00e9vel is haszn\u00e1lhat\u00f3. L\u00e9nyeg\u00e9ben egy k\u00f6nny\u0171, t\u00f6bbsz\u00e1l\u00fa megold\u00e1s, amely \u00faj funkci\u00f3kat k\u00edn\u00e1l, mik\u00f6zben bar\u00e1ts\u00e1gos marad a Snort felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra.<\/p>\n<p><b>El\u0151ny\u00f6k<\/b><\/p>\n<ul>\n<li>Teljes m\u00e9rt\u00e9kben kompatibilis a Snort adatb\u00e1zissal, szab\u00e1lyaival \u00e9s felhaszn\u00e1l\u00f3i fel\u00fclet\u00e9vel;<\/li>\n<li>A t\u00f6bbsz\u00e1l\u00fa architekt\u00fara nagy teljes\u00edtm\u00e9nyt biztos\u00edt.<\/li>\n<\/ul>\n<p><b>H\u00e1tr\u00e1nyok<\/b><\/p>\n<ul>\n<li>Viszonylag fiatal projekt, kis k\u00f6z\u00f6ss\u00e9ggel;<\/li>\n<li>Bonyolult telep\u00edt\u00e9si folyamat, amely mag\u00e1ban foglalja a teljes SIEM forr\u00e1sk\u00f3db\u00f3l val\u00f3 \u00f6ssze\u00e1ll\u00edt\u00e1s\u00e1t.<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/beave\/sagan\/\"><b>Forr\u00e1s<\/b><\/a><\/noindex><\/p>\n<h2>Z\u00e1r\u00e1s<\/h2>\n<p>Mindegyik eml\u00edtett SIEM rendszernek megvannak a maga saj\u00e1toss\u00e1gai \u00e9s korl\u00e1tai, ez\u00e9rt nem nevezhet\u0151k univerz\u00e1lis megold\u00e1snak b\u00e1rmely szervezet sz\u00e1m\u00e1ra. Azonban ezek a megold\u00e1sok ny\u00edlt k\u00f3d\u00faak, ami lehet\u0151v\u00e9 teszi a telep\u00edt\u00e9st, tesztel\u00e9st \u00e9s \u00e9rt\u00e9kel\u00e9st t\u00falzott k\u00f6lts\u00e9gek n\u00e9lk\u00fcl.<\/p>\n<p><b>Milyen \u00e9rdekes olvasm\u00e1nyok tal\u00e1lhat\u00f3ak m\u00e9g a blogban <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cloud4y.ru\/?utm_source=habr&amp;utm_medium=referral&amp;utm_campaign=article\">Cloud4Y<\/a><\/noindex><\/b><\/p>\n<p>\u2192 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/459156\/\">A vil\u00e1g VNIITE: hogyan tal\u00e1lt\u00e1k ki a \"okos otthon\" rendszert a Szovjetuni\u00f3ban<\/a><\/noindex><br \/>\n\u2192 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/458330\/\">Hogyan seg\u00edtenek az ideginterfacek az emberis\u00e9gnek<\/a><\/noindex><br \/>\n\u2192 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/454278\/\">Kiberbiztos\u00edt\u00e1s az orosz piacon<\/a><\/noindex><br \/>\n\u2192 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cloud4y\/blog\/454274\/\">F\u00e9ny, kamera\u2026 felh\u0151: hogyan v\u00e1ltoztatj\u00e1k meg a felh\u0151k a filmes ipart<\/a><\/noindex><br \/>\n\u2192 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cloud4y\/blog\/453612\/\">Futball a felh\u0151kben \u2014 divat vagy sz\u00fcks\u00e9gszer\u0171s\u00e9g?<\/a><\/noindex><\/p>\n<p>Iratkozzon fel az <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/cloud4y\">Telegram<\/a><\/noindex>-csatorn\u00e1nkra, hogy ne maradjon le a leg\u00fajabb cikk\u00fcnkr\u0151l! Hetente legfeljebb k\u00e9tszer \u00edrunk \u00e9s csak hasznos tartalommal.<\/p>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cloud4y\/blog\/459442\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0427\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a \u0432 \u0418\u0422-\u0441\u0444\u0435\u0440\u0435 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e? \u041d\u0435\u0442, \u043d\u0435 \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u043d \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043f\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043d\u0430\u0437\u043e\u0432\u0451\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0418\u0433\u043e\u0440\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u043b \u0432\u0447\u0435\u0440\u0430 \u043a\u043e\u043b\u043b\u0435\u0433\u0435 \u041c\u0430\u0440\u0438\u0438. \u0425\u043e\u0440\u043e\u0448\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a \u0441\u0442\u0430\u0440\u0430\u0435\u0442\u0441\u044f \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u0438 \u043e\u0442\u043b\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u043f\u0440\u0438\u043b\u0430\u0433\u0430\u044f \u0432\u0441\u0435 \u0441\u0438\u043b\u044b, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0431\u044b\u043b\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430. \u0421\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27082,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0427\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a \u0432 \u0418\u0422-\u0441\u0444\u0435\u0440\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd475 open-source \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0427\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a \u0432 \u0418\u0422-\u0441\u0444\u0435\u0440\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:10:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-12-21T07:34:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd475 open-source biztons\u00e1gi esem\u00e9nykezel\u0151 rendszer | ProHoster","description":"Mi teszi j\u00f3v\u00e1 az IT ter\u00fclet\u00e9n dolgoz\u00f3 biztons\u00e1gi szakembert.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475 open-source \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0427\u0435\u043c \u0445\u043e\u0440\u043e\u0448\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a \u0432 \u0418\u0422-\u0441\u0444\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/5-open-source-sistem-upravleniya-sobytiyami-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:16+00:00","article:modified_time":"2020-12-21T07:34:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36204","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:25:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:48:27","updated":"2026-01-22 02:25:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/36204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=36204"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/36204\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/27082"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=36204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=36204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=36204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}