MODELING INTRUSION DETECTION AND PREVENTION SYSTEM TO DETECT AND PREVENT NETWORK ATTACKS USING WAZUH

The rapid development of technology has a positive impact on society. The internet can be easily accessed anytime and anywhere, but with the advancement of internet technology, there are many threats lurking in the security of its users. Criminal activities in the digital world are referred to as cybercrime. Numerous cases of cybercrime have occurred worldwide, ranging from attacks that can disable servers to data theft and illegal access. It is noted that more than 50% of companies do not have a plan to respond to these cybercrimes. This is due to various factors, one of which is the limited availability of freely accessible and easily configurable network security platforms for all users. Therefore, this research aims to provide a solution in the form of an open-source-based Intrusion Detection and Prevention System (IDPS) that can be freely distributed and easily configured, one of which is Wazuh. The study uses the Cisco PPDIOO approach in developing a virtual lab with various scenarios for testing and measuring the Quality of Services (QoS) of Wazuh's performance. From the created test scenarios, Wazuh can detect attacks from both inside and outside the network. Wazuh has proven to be capable of detecting and preventing various types of network attacks and features that can facilitate users in responding to cybercrime, making it a potential solution for organizations that have not planned to respond to cybercrime.