Processing of Notifications Produced by Intrusion Detection Systems in CERN’s Security Operations Centre

This thesis focuses on the implementation of an application processing notifications produced by intrusion detection systems. Notifications are produced upon detection of a known indicator of compromise in the network traffic between CERN’s internal network and the internet. The enrichment is a part of CERN’s security operations centre, and should provide the data analyst a better, more informative and correct overview of the incident in question. The application retrieves notifications from a time window, processes them by inflating fields to contain data about involved devices and information about the threats that are linked to this indicator of compromise. Finally the notifications are aggregated and sent to the relevant persons by email