Implementasi Mini Security Operations Center (SOC) Berbasis Wazuh-Suricata Untuk Deteksi Dini Dan Analisis Insiden Keamanan Jaringan

The Computer Network Laboratory of the Department of Informatics Engineering at Politeknik Negeri Bengkalis does not yet have a centralized network security system for monitoring and detecting security incidents. This research implements a Mini Security Operations Center (SOC) based on Wazuh and Suricata to perform network security monitoring, threat detection, and response. The system was evaluated using five attack scenarios, namely port scanning, SSH brute force, SQL Injection, ICMP Flood, and HTTP Flood, with each scenario conducted ten times. The results showed that the average system response time was 1.9 seconds for port scanning, 3.2 seconds for SSH brute force, 5.0 seconds for SQL Injection, 1.5 seconds for ICMP Flood, and 2.7 seconds for HTTP Flood. In addition, the system successfully detected all attack scenarios, displayed security logs through the Wazuh Dashboard, and automatically responded to threats using Suricata IPS and Wazuh Active Response. The implementation of the Mini SOC helps improve network security monitoring in the Computer Network Laboratory of the Department of Informatics Engineering at Politeknik Negeri Bengkalis.