Đề án Thạc sĩ: Nghiên cứu tích hợp EDR cho hệ thống SIEM nhằm nâng cao hiệu quả giám sát an toàn thông tin cho tổ chức

The contemporary cybersecurity landscape is characterized by increasingly sophisticated and frequent threats, including ransomware, social engineering, and AI-driven attacks, which traditional security tools often fail to address effectively. This escalating threat environment, coupled with the expansion of attack surfaces due to remote work and cloud adoption, necessitates robust and comprehensive security monitoring solutions. While Security Information and Event Management (SIEM) systems provide broad network visibility and Endpoint Detection and Response (EDR) focuses on deep endpoint protection, deploying them separately presents inherent limitations. This study addresses these challenges by proposing an integrated EDR-SIEM model to enhance the effectiveness of information security monitoring for organizations, aiming to bridge detection gaps, improve incident response times, and build a more resilient defense against advanced cyber threats.

Cybersecurity professionals, security analysts, IT managers, and researchers interested in advanced threat detection, incident response, and security information and event management.

This academic work critically examines the limitations of standalone SIEM and EDR systems in safeguarding organizations against evolving cyber threats and proposes a comprehensive integration model to enhance information security monitoring. The research begins by establishing the necessity for advanced threat detection and rapid response capabilities in today's complex digital environment, where traditional security measures are insufficient. It delves into the architectural components, functionalities, and inherent constraints of both SIEM (e.g., Splunk, QRadar, ELK) and EDR solutions (e.g., Trend Vision One, CrowdStrike Falcon, Microsoft Defender for Endpoint).
The core methodology involves analyzing an existing SIEM infrastructure within a specific organization (SOTA Vietnam) to identify current shortcomings, particularly in endpoint-contextual detection. Subsequently, the study proposes a detailed EDR-SIEM integration architecture, exploring various technical approaches such as API integration, standardized data formats (Syslog), and dedicated connectors. A crucial aspect of this research is the development and execution of a simulated test environment to evaluate the integrated system's performance. This involves simulating common attack scenarios, including malware infections, fileless attacks, and exploit attempts, to assess improvements in threat detection, alert correlation, and incident response efficiency compared to non-integrated systems.
The findings demonstrate that integrating EDR with SIEM significantly enhances an organization's ability to identify and respond to sophisticated cyber threats, reducing blind spots and improving the Mean Time To Respond (MTTR). This integrated approach provides a holistic view of the security posture, optimizes security operations, and ultimately contributes to a more robust and adaptive defense strategy, offering valuable insights for cybersecurity professionals seeking to fortify their security frameworks.