Cyberattack Detection and Mitigation in a Security Operations Center (SOC) Using Free Software SIEM Tools in Kali Purple

Fernando Espinoza León J. · Proceedings of the LACCEI international Multi-conference for Engineering, Education and Technology (2026) · DOI: 10.18687/laccei2026.1.1.1425

Resumen

The continuous growth and increasing sophistication of cyber threats have strengthened the need for advanced monitoring, detection, and incident response mechanisms in Security Operations Centers (SOC). In this context, Security Information and Event Management (SIEM) systems play a key role in event correlation and threat detection. This paper presents the design, implementation, and experimental evaluation of a SOC laboratory environment based on Kali Purple, focused on assessing the performance of open-source SIEM tools. The environment integrates Wazuh, Suricata, Zeek, Elastic Stack, and TheHive. Controlled attack scenarios were executed, including SSH brute force, DNS tunneling, and HTTP command-and-control (C2). The evaluation was conducted using quantitative metrics such as True Positive Rate (TPR), False Positive Rate (FPR), Mean Time to Detect (MTTD), and Mean Time to Respond (MTTR). The results demonstrate high detection accuracy (TPR up to 0.98) and low false positive rates (below 0.03), confirming the effectiveness of the proposed approach in controlled environments.