{"id":941,"date":"2025-10-08T14:42:49","date_gmt":"2025-10-08T12:42:49","guid":{"rendered":"https:\/\/webcatalyste.fr\/?page_id=941"},"modified":"2025-10-09T14:29:00","modified_gmt":"2025-10-09T12:29:00","slug":"941-2","status":"publish","type":"page","link":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941","title":{"rendered":"SIEM \/ XDR (EGID \u2013 ELK)"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"941\" class=\"elementor elementor-941\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-690b947 e-flex e-con-boxed e-con e-parent\" data-id=\"690b947\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e1e07b2 elementor-invisible elementor-widget elementor-widget-heading\" data-id=\"e1e07b2\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_animation&quot;:&quot;fadeIn&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">SIEM \/ XDR (EGID \u2013 ELK)<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9bec90f e-flex e-con-boxed e-con e-parent\" data-id=\"9bec90f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-ed7d4bc e-con-full e-flex e-con e-child\" data-id=\"ed7d4bc\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-83578b3 elementor-widget elementor-widget-image\" data-id=\"83578b3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"260\" height=\"300\" src=\"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-260x300.png\" class=\"attachment-medium size-medium wp-image-954\" alt=\"\" srcset=\"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-260x300.png 260w, https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-768x885.png 768w, https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1.png 889w\" sizes=\"(max-width: 260px) 100vw, 260px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fd79394 e-con-full e-flex e-con e-child\" data-id=\"fd79394\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c950a78 e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"c950a78\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3 class=\"p1\"><span style=\"color: #333399;\"><b>Contexte &amp; cadrage<\/b><\/span><b><\/b><\/h3><ul><li><p class=\"p1\"><b>\u00c9tablissement<\/b><span class=\"s1\"> : ESIEA<\/span><\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>P\u00e9riode<\/b><\/span> : avril \u2192 juin 2024 (\u2248 10\u201312 semaines)<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>\u00c9quipe<\/b><\/span> : 3 personnes \u2014 <span class=\"s1\"><b>r\u00f4le : chef de projet<\/b><\/span> (coordination, agents, dashboards, runbook)<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Objectif<\/b><\/span> : pr\u00e9senter un <span class=\"s1\"><b>SIEM fonctionnel<\/b><\/span> \u00e0 un jury mixte (pros &amp; non-tech), avec d\u00e9mo d\u2019incident<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-62785d5 e-flex e-con-boxed e-con e-parent\" data-id=\"62785d5\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-76f5fc2 e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"76f5fc2\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>TL;DR<\/b><\/span><\/h3><ul><li><p class=\"p1\">Infra <span class=\"s1\"><b>Elastic Cloud<\/b><\/span> (Elasticsearch\/Kibana manag\u00e9s)<\/p><\/li><li><p class=\"p1\"><b>2 endpoints Debian 11<\/b><span class=\"s1\"> reli\u00e9s via <\/span><b>Fleet \/ Elastic Agent<\/b><b><\/b><\/p><\/li><li><p class=\"p1\"><b>3 dashboards<\/b><span class=\"s1\"> (SSH, sudo, syst\u00e8me) + <\/span><b>alertes email<\/b><b><\/b><\/p><\/li><li><p class=\"p1\">D\u00e9mo \u201cbrute force \u2192 succ\u00e8s\u201d, \u201csudo hors horaires\u201d, \u201cfichier critique modifi\u00e9\u201d<\/p><\/li><li><p class=\"p1\"><b>KPI<\/b><span class=\"s1\"> : d\u00e9tection \u2248 <\/span><b>15 s<\/b><span class=\"s1\"> \u00b7 <\/span><b>4 alertes<\/b><span class=\"s1\"> d\u00e9clench\u00e9es \u00b7 <\/span><b>2 endpoints<\/b><span class=\"s1\"> \u00b7 <\/span><b>3 dashboards<\/b><\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-bd8df55 e-flex e-con-boxed e-con e-parent\" data-id=\"bd8df55\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-56d26e3 e-con-full e-flex e-con e-child\" data-id=\"56d26e3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f51b7b0 e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"f51b7b0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>Architecture\u00a0<\/b><\/span><\/h3><ul><li><p class=\"p1\"><span class=\"s1\"><b>Plateforme<\/b><\/span> : <i>Elastic Cloud<\/i> (Elasticsearch + Kibana)<\/p><\/li><li><p class=\"p1\"><b>Collecte<\/b><span class=\"s1\"> : <\/span><b>Elastic Agent<\/b><span class=\"s1\"> (Fleet) sur <\/span><b>2\u00d7 Debian 11<\/b><b><\/b><\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Int\u00e9grations<\/b><\/span> : System (syslog\/auth), <span class=\"s1\"><b>Auditd<\/b><\/span> (\u00e9v\u00e9nements sensibles)<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Alerting<\/b><\/span> : email (Kibana rules)<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-71bd05d e-con-full e-flex e-con e-child\" data-id=\"71bd05d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-95aac2e e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"95aac2e\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3 class=\"p1\"><span style=\"color: #333399;\">\u00a0<b>Ce que j\u2019ai fait\u00a0<\/b><\/span><\/h3><ul><li><p class=\"p1\"><span class=\"s1\"><b>D\u00e9ploiement des Elastic Agents<\/b><\/span> (Fleet) sur 2 h\u00f4tes Debian 11<\/p><\/li><li><p class=\"p1\"><b>Conception de 3 dashboards Kibana<\/b><span class=\"s1\"> :<\/span><\/p><ul><li><p class=\"p1\"><i>Authentifications &amp; SSH<\/i> (\u00e9checs, IP sources, comptes)<\/p><\/li><li><p class=\"p1\"><i>\u00c9l\u00e9vation &amp; sudo<\/i> (commandes sensibles, horaires)<\/p><\/li><li><p class=\"p1\"><i>Vue syst\u00e8me<\/i> (reboots, services, noyau\/Auditd)<\/p><\/li><\/ul><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Runbook &amp; doc de soutenance<\/b><\/span> (sc\u00e9nario, pas-\u00e0-pas, preuves \u00e0 montrer)<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-91b5233 e-flex e-con-boxed e-con e-parent\" data-id=\"91b5233\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-bf777ed e-con-full e-flex e-con e-child\" data-id=\"bf777ed\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fc4d5ee e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"fc4d5ee\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>D\u00e9mo d\u2019incident\u00a0<\/b><\/span><\/h3><ol start=\"1\"><li><p class=\"p1\"><span class=\"s1\"><b>Multiples \u00e9checs SSH<\/b><\/span> depuis l\u2019endpoint B vers A \u2192 alerte \u201cbrute force SSH\u201d<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Connexion r\u00e9ussie<\/b><\/span> juste apr\u00e8s la rafale d\u2019\u00e9checs \u2192 alerte \u201csucc\u00e8s apr\u00e8s \u00e9checs\u201d<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Commande sudo hors 22h\u201306h<\/b><\/span> \u2192 alerte \u201csudo sensible hors horaires\u201d<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Modification d\u2019un fichier critique<\/b><\/span> (<span class=\"s2\">\/etc\/ssh\/sshd_config<\/span>) \u2192 alerte \u201cfichier critique modifi\u00e9\u201d<\/p><\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8f6df3a e-con-full e-flex e-con e-child\" data-id=\"8f6df3a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8a79791 e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"8a79791\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>R\u00e9sultats &amp; KPI<\/b><\/span><\/h3><ul><li><p class=\"p1\"><span class=\"s1\"><b>D\u00e9tection ~15 s<\/b><\/span> (du log \u00e0 l\u2019alerte visible)<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>4 alertes<\/b><\/span> d\u00e9clench\u00e9es pendant la d\u00e9mo<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>2 endpoints<\/b><\/span> Debian 11 couverts<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>3 dashboards<\/b><\/span> op\u00e9rationnels (SSH, sudo, syst\u00e8me)<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3f04118 e-flex e-con-boxed e-con e-parent\" data-id=\"3f04118\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-cf812d7 e-con-full e-flex e-con e-child\" data-id=\"cf812d7\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7b8959d e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"7b8959d\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>Difficult\u00e9s &amp; le\u00e7ons<\/b><\/span><\/h3><ul><li><p class=\"p1\"><span class=\"s1\"><b>Qualit\u00e9 des donn\u00e9es &gt; quantit\u00e9<\/b><\/span> : mieux vaut 2 sources <span class=\"s1\"><b>propres<\/b><\/span> (System + Auditd) que 6 mal normalis\u00e9es<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Bruit d\u2019alerte<\/b><\/span> : limiter les faux positifs avant d\u2019ajouter des r\u00e8gles \u201cavanc\u00e9es\u201d<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>P\u00e9dagogie jury<\/b><\/span> : traduire le signal technique en <span class=\"s1\"><b>sc\u00e9narios compr\u00e9hensibles<\/b><\/span> (qui\/quoi\/quand\/impact)<\/p><\/li><\/ul><p><span style=\"color: #333399;\"><strong>Am\u00e9lioration prioritaire<\/strong><\/span><\/p><ul><li><p class=\"p1\"><span class=\"s1\"><b>Automatiser le d\u00e9ploiement des agents<\/b><\/span> (Ansible)\u00a0<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d606121 e-con-full e-flex e-con e-child\" data-id=\"d606121\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4a3585b e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"4a3585b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>Stack &amp; comp\u00e9tences mobilis\u00e9es<\/b><\/span><\/h3><ul><li><p class=\"p1\"><b>Elastic Cloud<\/b><span class=\"s1\"> (Elasticsearch, Kibana) \u00b7 <\/span><b>Fleet\/Elastic Agent<\/b><span class=\"s1\"> \u00b7 <\/span><b>Auditd<\/b><b><\/b><\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Debian 11<\/b><\/span> \u00b7 SSH\/Journalctl \u00b7 notions r\u00e9seau L2\/L3<\/p><\/li><li><p class=\"p1\"><span class=\"s1\"><b>Alerting email<\/b><\/span> (Kibana), <span class=\"s1\"><b>dashboards<\/b><\/span> orient\u00e9s investigation<\/p><\/li><li><p class=\"p1\">Gestion de projet (cadence, r\u00e9partition, <span class=\"s1\"><b>runbook<\/b><\/span>)<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-1a6a8df e-flex e-con-boxed e-con e-parent\" data-id=\"1a6a8df\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-834cace e-transform e-transform elementor-widget elementor-widget-text-editor\" data-id=\"834cace\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_transform_scale_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:1.01,&quot;sizes&quot;:[]},&quot;_animation&quot;:&quot;none&quot;,&quot;_transform_rotateZ_effect_hover&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_rotateZ_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;deg&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;_transform_scale_effect_hover_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3><span style=\"color: #333399;\"><b>R\u00e9ception du jury<\/b><\/span><\/h3><ul><li><p class=\"p1\"><span class=\"s1\"><b>Curiosit\u00e9 et int\u00e9r\u00eat<\/b><\/span> : d\u00e9mo lisible, bons \u00e9changes<\/p><\/li><li><p class=\"p1\">Point d\u2019attention : <span class=\"s1\"><b>vulgariser<\/b><\/span> les notions (logs \u2192 d\u00e9tection \u2192 alerte \u2192 d\u00e9cision)<b><\/b><\/p><\/li><\/ul><h3 class=\"p1\"><span style=\"color: #333399;\"><b>En quoi ce projet m&rsquo;a \u00e9t\u00e9 utile<\/b><\/span><\/h3><ul><li><p class=\"p1\">Capacit\u00e9 \u00e0 <span class=\"s1\"><b>mettre en place un socle SIEM<\/b><\/span> simple et exploitable rapidement<\/p><\/li><li><p class=\"p1\">R\u00e9flexe <span class=\"s1\"><b>d\u2019hygi\u00e8ne s\u00e9cu<\/b><\/span> (SSH, sudo, fichiers critiques) et <span class=\"s1\"><b>observabilit\u00e9<\/b><\/span> de base<\/p><\/li><li><p class=\"p1\">Documentation et <span class=\"s1\"><b>sc\u00e9narisation<\/b><\/span> pr\u00eates pour l\u2019op\u00e9rationnel<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>SIEM \/ XDR (EGID \u2013 ELK) Contexte &amp; cadrage \u00c9tablissement : ESIEA P\u00e9riode : avril \u2192 juin 2024 (\u2248 10\u201312 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"full-width-container","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-941","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.1.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>SIEM \/ XDR (EGID \u2013 ELK) - WebCatalyste<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SIEM \/ XDR (EGID \u2013 ELK) - WebCatalyste\" \/>\n<meta property=\"og:description\" content=\"SIEM \/ XDR (EGID \u2013 ELK) Contexte &amp; cadrage \u00c9tablissement : ESIEA P\u00e9riode : avril \u2192 juin 2024 (\u2248 10\u201312 [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941\" \/>\n<meta property=\"og:site_name\" content=\"WebCatalyste\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-09T12:29:00+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-260x300.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941\",\"url\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941\",\"name\":\"SIEM \/ XDR (EGID \u2013 ELK) - WebCatalyste\",\"isPartOf\":{\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#primaryimage\"},\"image\":{\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#primaryimage\"},\"thumbnailUrl\":\"http:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-260x300.png\",\"datePublished\":\"2025-10-08T12:42:49+00:00\",\"dateModified\":\"2025-10-09T12:29:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#primaryimage\",\"url\":\"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1.png\",\"contentUrl\":\"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1.png\",\"width\":889,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/portfolio.webcatalyste.fr\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SIEM \/ XDR (EGID \u2013 ELK)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/#website\",\"url\":\"https:\/\/portfolio.webcatalyste.fr\/\",\"name\":\"WebCatalyste\",\"description\":\"\u00c9levez votre vision, r\u00e9alisez votre potentiel\",\"publisher\":{\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/portfolio.webcatalyste.fr\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/#organization\",\"name\":\"WebCatalyste\",\"url\":\"https:\/\/portfolio.webcatalyste.fr\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2024\/11\/cropped-transparent_logo_WebCatalyste-removebg-preview.png\",\"contentUrl\":\"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2024\/11\/cropped-transparent_logo_WebCatalyste-removebg-preview.png\",\"width\":183,\"height\":183,\"caption\":\"WebCatalyste\"},\"image\":{\"@id\":\"https:\/\/portfolio.webcatalyste.fr\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SIEM \/ XDR (EGID \u2013 ELK) - WebCatalyste","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941","og_locale":"fr_FR","og_type":"article","og_title":"SIEM \/ XDR (EGID \u2013 ELK) - WebCatalyste","og_description":"SIEM \/ XDR (EGID \u2013 ELK) Contexte &amp; cadrage \u00c9tablissement : ESIEA P\u00e9riode : avril \u2192 juin 2024 (\u2248 10\u201312 [&hellip;]","og_url":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941","og_site_name":"WebCatalyste","article_modified_time":"2025-10-09T12:29:00+00:00","og_image":[{"url":"http:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-260x300.png","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Dur\u00e9e de lecture estim\u00e9e":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941","url":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941","name":"SIEM \/ XDR (EGID \u2013 ELK) - WebCatalyste","isPartOf":{"@id":"https:\/\/portfolio.webcatalyste.fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#primaryimage"},"image":{"@id":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#primaryimage"},"thumbnailUrl":"http:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1-260x300.png","datePublished":"2025-10-08T12:42:49+00:00","dateModified":"2025-10-09T12:29:00+00:00","breadcrumb":{"@id":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/portfolio.webcatalyste.fr\/?page_id=941"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#primaryimage","url":"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1.png","contentUrl":"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2025\/10\/MicrosoftTeams-image-1.png","width":889,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/portfolio.webcatalyste.fr\/?page_id=941#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/portfolio.webcatalyste.fr\/"},{"@type":"ListItem","position":2,"name":"SIEM \/ XDR (EGID \u2013 ELK)"}]},{"@type":"WebSite","@id":"https:\/\/portfolio.webcatalyste.fr\/#website","url":"https:\/\/portfolio.webcatalyste.fr\/","name":"WebCatalyste","description":"\u00c9levez votre vision, r\u00e9alisez votre potentiel","publisher":{"@id":"https:\/\/portfolio.webcatalyste.fr\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/portfolio.webcatalyste.fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/portfolio.webcatalyste.fr\/#organization","name":"WebCatalyste","url":"https:\/\/portfolio.webcatalyste.fr\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/portfolio.webcatalyste.fr\/#\/schema\/logo\/image\/","url":"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2024\/11\/cropped-transparent_logo_WebCatalyste-removebg-preview.png","contentUrl":"https:\/\/portfolio.webcatalyste.fr\/wp-content\/uploads\/2024\/11\/cropped-transparent_logo_WebCatalyste-removebg-preview.png","width":183,"height":183,"caption":"WebCatalyste"},"image":{"@id":"https:\/\/portfolio.webcatalyste.fr\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=\/wp\/v2\/pages\/941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=941"}],"version-history":[{"count":16,"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=\/wp\/v2\/pages\/941\/revisions"}],"predecessor-version":[{"id":1001,"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=\/wp\/v2\/pages\/941\/revisions\/1001"}],"wp:attachment":[{"href":"https:\/\/portfolio.webcatalyste.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}