Enhancing Security Operations Center: Wazuh Security Event Response with Retrieval-Augmented-Generation-Driven...

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Information Security

Background:

• Increasingly sophisticated cyberthreats necessitate advanced tools for Security Operations Centers (SOCs).
• Existing incident response mechanisms require augmentation to effectively manage complex security breaches.
• The need for intelligent systems to support security analysts in real-time is paramount.

Purpose of the Study:

• To develop and evaluate the Security Event Response Copilot (SERC) system.
• To enhance the efficiency and effectiveness of SOCs in managing and mitigating security incidents.
• To integrate AI-driven insights with established cybersecurity frameworks for improved threat response.

Main Methods:

• Development of the SERC system, integrating Retrieval-Augmented Generation (RAG) for data extraction and Large Language Models (LLMs) for response guidance.
• Utilization of Wazuh, an open-source Security Information and Event Management (SIEM) platform, for collecting and analyzing security event data.
• Application of RAG to vectorized data collections including incident response knowledge, MITRE ATT&CK, and NIST Cybersecurity Framework (CSF) 2.0.

Main Results:

• SERC effectively assists security analysts in responding to and mitigating security breaches.
• The system demonstrates the successful integration of structured threat intelligence with AI models.
• Wazuh's SIEM capabilities empower SERC to provide context-specific insights for precise threat identification.

Conclusions:

• The combination of RAG, LLMs, and robust SIEM platforms like Wazuh significantly enhances SOC capabilities.
• SERC offers a promising approach to address the dynamic challenges in modern cybersecurity environments.
• The system bridges strategic risk management and tactical intelligence for improved cybersecurity posture.