ahmzan / S1EM

This project is a SIEM with SIRP and Threat Intel, all in one.

Objectives

Today, cyber attacks are more numerous and cause damage in companies. Nevertheless, many software products exist to detect cyber threats. The S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly interoperable.

S1EM is a SIEM with SIRP and Threat Intel, a full packet capture, all in one.

Inside the solution:

• Cluster Elasticsearch
• Kibana
• Filebeat
• Logstash
• Metricbeat
• Heartbeat
• Auditbeat
• Shuffle
• Spiderfoot
• Syslog-ng
• Elastalert
• TheHive
• Cortex
• MISP
• OpenCTI
• Arkime
• Suricata
• Zeek
• StoQ
• Mwdb
• Traefik
• Clamav
• Codimd
• Watchtower
• Homer

Note: Cortex v3.1 use ELK connector and the OpenCTI v4 connector

Guides

• Installation Guide
• Access Guide
• Configuration Guide
• Upgrade guide
• Detection Guide
• Incident Response Guide
• Threat Intel Guide
• Agent Guide
• Architecture Guide
• Troubleshooting Guide
• Use EDR Elastic with S1EM
• Use TPOT with S1EM
• Screenshot of S1EM

Roadmap

• Change docker Postgres and Mysql for multi databases
• Add Spiderfoot
• Add SOAR shuffle
• Add OpenCVE
• Add Codimd
• Suppress heimdall for Homer
• The complete documentation
• Upgrade to elastalert2
• SSO
• Interact with Lab-DFIR-SOC (https://github.com/StevenDias33/Lab-DFIR-SOC)
• Add Capa

Related project

https://www.elastic.co
https://github.com/TheHive-Project/Docker-Templates
https://github.com/jasonish/docker-suricata
https://github.com/blacktop/docker-zeek
https://github.com/rskntroot/arkime
https://github.com/coolacid/docker-misp
https://github.com/watsoninfosec/ElasticXDR
https://github.com/PUNCH-Cyber/stoq
https://github.com/jertel/elastalert-docker
https://github.com/OpenCTI-Platform/docker
https://github.com/CERT-Polska/mwdb-core
https://github.com/SigmaHQ/sigma
https://github.com/Yara-Rules/rules
https://traefik.io/
https://docs.linuxserver.io/images/docker-heimdall
https://github.com/cisagov/Malcolm
https://github.com/blueimp/jQuery-File-Upload
https://gchq.github.io/CyberChef/
https://www.clamav.net/
https://www.syslog-ng.com/
https://github.com/bastienwirtz/homer

Special thanks

En français cette fois.
Merci à mes amis et collègues qui m´ont inspiré toutes ces années, qui m´ont aidé, et corrigé des bugs. Je pense à Kidrek, Juju, mlp1515, Wagga40, Xophidia, StevenDias33, Frak113, HiPizzaa,et tous ceux qui n´ont pas forcement de compte github.
Merci à vous :)

Liens github:
https://github.com/kidrek
https://github.com/mlp1515
https://github.com/frack113
https://github.com/StevenDias33
https://github.com/wagga40
https://github.com/xophidia