Basic SIEM Setup and Log Collection using Splunk

In this lab, you will follow along with Samantha, a SOC analyst in training, as she builds the foundation of a Security Information and Event Management (SIEM) solution using Splunk. The goal of this lab is to help Samantha (and you) set up Splunk to collect and analyze logs from multiple sources across the network.

You will begin by verifying that logs from both Ubuntu and Windows forwarders are being successfully ingested into Splunk. After ensuring proper log ingestion, you will move on to analyze key events such as successful and failed login attempts and system-level errors, which are critical for maintaining the security posture of the organization.

This lab simulates a real-world SOC environment where multiple machines generate logs, and Samantha leverages Splunk to monitor and analyze those logs. By the end of this lab, you will have a solid understanding of how to set up a basic SIEM environment, analyze system logs for key security events, and ensure that your SIEM system is ready to detect potential threats in real-time.

Goals:

• Establish a Basic SIEM Setup: Samantha will build a foundational SIEM environment using Splunk to collect and analyze logs from critical systems.
• Real-Time Log Ingestion: Configure log forwarding from both Windows and Ubuntu systems into Splunk, ensuring real-time log ingestion for security event monitoring.
• Detect and Analyze Key Events: Identify and analyze important security events such as login attempts, system errors, and potential attacks from the simulated attacker.

Objectives:

• Verify Log Ingestion:
  • Confirm that logs from Windows (VM2) and Ubuntu (VM3) forwarders are successfully ingested into the Splunk server (VM1).
• Analyze Logs for Critical Events:
  • Search for key events like accepted/failed login attempts and system/application errors from both the Windows and Ubuntu VMs.

• VM1 - Splunk Server (Jumpbox): Splunk Enterprise, Remmina Client (for remote access to VMs)
• VM2 - Windows Forwarder: Windows 10/11, Splunk Universal Forwarder
• VM3 - Ubuntu Forwarder: Ubuntu, Splunk Universal Forwarder, Nginx (for log generation)
• VM4 - Ubuntu (Attacker): Ubuntu (used to simulate malicious activities for security event testing)