SOC Threat Detection & Incident Response Lab
A virtual SOC lab where a Windows 11 endpoint ships security events through a Wazuh Agent to a Wazuh Manager on Ubuntu Server, used to practise log collection, detection rules and alert investigation.
- Windows Security event collection via Wazuh Agent
- Failed-login monitoring (Event ID 4625)
- Detection rules and alert severity levels
- Security-event investigation and threat hunting
- Wazuh SIEM
- Ubuntu Server
- Windows 11
- VirtualBox
- Windows Security Event Logs
- 01Windows Endpoint
- 02Wazuh Agent
- 03Wazuh Manager
- 04Security Dashboard
- 05Alert Investigation
