Analisis Komparatif Respons Insiden DDoS: Efisiensi MTTR pada Penanganan Manual Versus Otomatis Berbasis SIEM dan SOAR

Darmayoga, I Nyoman
Mardhiyyah, Rodhiyah

TIN: TERAPAN INFORMATIKA NUSANTARA
Vol 6 No 8 (2026): January 2026

The increasing use of digital services in Indonesia has been accompanied by a growing number of cybersecurity threats, particularly DDoS attacks that target service availability. One real-world incident occurred on the news website Suara.com, which experienced a large-scale DDoS attack that was handled manually by the technical team. The manual handling of this incident revealed limitations in terms of the speed and measurability of the initial response, as not all response stages were systematically documented. This study aims to compare the mechanisms and speed of initial responses between manual handling of the DDoS incident on Suara.com and automated responses using the SYRA system. SYRA is a web-based security system developed to support automated detection and response to cyber incidents through the integration of SIEM and SOAR. The research method used is a comparative study that utilizes public data from the chronology of the Suara.com incident as a representation of manual response, as well as data from DDoS attack testing on the SYRA system conducted in a controlled environment as a representation of automated response. The main parameter used in the analysis is MTTR as an indicator of initial response speed. The results show that the SYRA system is able to execute initial responses consistently with an average MTTR value of 42.97 seconds, allowing initial mitigation actions to be carried out in less than one minute after the attack is detected. These findings indicate that the implementation of automated response plays an important role in maintaining the continuity of digital services, particularly in the media and public service sectors that are highly dependent on system availability.