Evaluasi dan Analisis Kapabilitas Deteksi Security Information and Event Management (SIEM) Berbasis MITRE ATT&CK

Maria Clareta Febriani, Dr. Lukman Heryawan, S.T., M.T.; Muhammad Oriza Nurfajri, S.Kom., M.IT.

2026 | Skripsi | ILMU KOMPUTER

Kecepatan serangan siber saat ini sering kali melampaui kemampuan deteksi sistem keamanan, sehingga keterlambatan deteksi memperbesar peluang penyerang untuk memperluas dampak insiden. Evaluasi Security Information and Event Management (SIEM) umumnya berhenti pada cakupan deteksi tanpa menilai kualitas atribusi terhadap teknik adversary dan tanpa prosedur pengukuran latensi yang terdokumentasi, sehingga hasilnya sulit diaudit dan dibandingkan. Penelitian ini mengevaluasi kapabilitas deteksi Wazuh 4.14.4 dengan default ruleset terhadap 12 teknik MITRE ATT&CK menggunakan Atomic Red Team pada lingkungan laboratorium terisolasi. Metodologi mengikuti prinsip purple teaming dengan kerangka klasifikasi kapabilitas deteksi berbasis tingkatan Detection Coverage (DC), memanfaatkan kueri dua indeks (wazuh-alerts-* dan wazuh-archives-*) untuk memisahkan rule gap dari visibility gap, pelabelan berbasis oracle, dan pengukuran latensi. Pengujian mencakup 21 subtes dengan lima pengulangan sehingga menghasilkan 105 pengulangan. Hasil menunjukkan relaxed coverage atau recall tingkat subtes sebesar 90,5?ngan 19 dari 21 subtes terdeteksi, namun disertai attribution gap sebesar 73,7% karena hanya 26,3?teksi yang mencapai atribusi teknik tepat, serta beban alert tidak relevan yang tinggi. Seluruh kegagalan deteksi merupakan fenomena rule gap karena tidak terdapat alert relevan meskipun log tersedia dan dapat ditelusuri. Latensi deteksi dilaporkan dengan median Time to Detect sekitar 1,05 detik, dengan komponen Lag2 yang mendominasi latensinya berdasarkan dekomposisi latensi. Penelitian ini menyimpulkan bahwa cakupan deteksi yang luas tidak setara dengan ketepatan atribusi teknik, serta menghasilkan kerangka evaluasi yang reproducible.

The speed of modern cyberattacks frequently outpaces the detection capabilities of security systems, where detection delays significantly increase the adversary's opportunity to escalate the incident's impact. Evaluation of Security Information and Event Management (SIEM) systems commonly stops at detection coverage without assessing the quality of attribution to adversary techniques and without a documented latency measurement procedure, making results difficult to audit and compare. This research evaluates the detection capability of the  Wazuh 4.14.4 with default ruleset against 12 MITRE ATT&CK techniques using Atomic Red Team in an isolated laboratory environment. The methodology follows a purple teaming principle with a detection capability classification framework based on Detection Coverage (DC) tiers, employing a dual-index query  (wazuh-alerts-* dan wazuh-archives-*) to separate rule gaps from visibility gaps, oracle-based labeling, and latency measurement. Testing covered 21 subtests with five repetitions, yielding 105 executions. The results show relaxed coverage or subtest-level recall of 90.5%, with 19 of 21 subtests detected. However, the result was accompanied by an attribution gap of 73.7?cause only 26.3% of detections reached exact technique attribution. All detection failures were rule gaps because no relevant alerts were generated despite log being available and traceable. Detection latency is reported with median Time to Detect of approximately 1.05 seconds, with Lag2 as the dominant component based on latency decomposition. This research concludes that broad detection coverage does not equate to accurate technique attribution, and it delivers a reproducible evaluation framework.

Kata Kunci : SIEM, Wazuh, MITRE ATT&CK, Atomic Red Team, detection coverage, attribution gap, detection latency