Cybersecurity · intermediate

SIEM Home Lab with Detection Engineering

A working Wazuh SIEM ingesting Windows and Linux logs, with custom detection rules mapped to MITRE ATT&CK — and a simulated attack that proves they fire.

Project overview

Nearly every entry-level security job is a blue-team job, but most portfolios are all offense — scanners, pentest scripts, CTF writeups. A SIEM lab with detections you wrote yourself proves you can do the work a SOC actually hires for: turn raw logs into alerts that catch real behavior.

Real-world use case

A SOC team onboards a new log source and needs custom rules to detect credential dumping and persistence techniques that the vendor default ruleset misses entirely.

Tools and technologies

• Wazuh
• Sysmon
• Sigma
• MITRE ATT&CK
• VirtualBox

Skills you can demonstrate

Detection Engineering, Log Analysis, MITRE ATT&CK Mapping, Blue Team Operations

Build roadmap

1. Stand up the lab
   Create two VMs in VirtualBox — a Wazuh server (Ubuntu) and a Windows 10/11 victim. Get them on the same host-only network so nothing touches your real LAN.
2. Install Wazuh and onboard agents
   Deploy the Wazuh manager, then install agents on both machines. Confirm logs are arriving in the dashboard before you write a single rule.
3. Add Sysmon for real telemetry
   Install Sysmon on the Windows host with a well-known config (SwiftOnSecurity is the standard starting point). This is what turns thin Windows logs into detection-grade data.
4. Write your first detections
   Pick 3–5 MITRE techniques and write a rule for each. Start with process creation and persistence — they are the easiest to trigger safely. Use the AI prompt below.
5. Simulate the attacks
   Use Atomic Red Team to run the exact techniques you wrote rules for. Confirm each alert fires. Document any that did not, and fix them — this iteration is the actual skill.
6. Build the coverage report
   Map your rules to an ATT&CK Navigator layer showing what you cover and what you do not. Honest gaps read as maturity, not weakness. Screen-record one detection end to end.

Ways to extend the project

Add an active-response rule that automatically isolates a host when a high-severity detection fires, then document the false-positive rate over a week of normal use.

How to showcase your work

• GitHub: Repo with your custom rule files, a MITRE coverage matrix showing which techniques you detect, and screenshots of alerts firing during the attack simulation.
• LinkedIn: Post the before/after — an attack technique running undetected, then the same technique lighting up your dashboard after you wrote the rule.
• Resume: Focus on "Detection engineering", "MITRE ATT&CK mapping", and "SIEM administration".