Source code, documentation and tests are available on GitHub.
01 / CONTEXT
Project context
A dashboard full of alerts is not enough to demonstrate detection capability. The goal was to generate meaningful telemetry, design precise detection logic and show how observed events support defensible investigation decisions.
02 / EXECUTION
What I did
Built a Wazuh manager and monitored Ubuntu endpoint on Hyper-V, collecting auditd, SSH and file-integrity events.
Authored seven custom Wazuh XML rules for controlled configuration changes, privilege-related activity and correlated event sequences.
Ran positive and negative tests, traced alerts to source logs, documented two simulated incident investigations and verified cleanup.
Recorded 20 scoped CIS-aligned checks and explained the lab's network isolation boundaries.
SYSTEM FLOW
Local detection and investigation flow
01Monitored Ubuntu endpointSSH, auditd and file-integrity events
02Wazuh managerCollects and processes endpoint telemetry
03Custom detection rulesLocal XML rules and controlled correlation tests
04Investigation and reviewSource logs, negative controls and IR reports
Conceptual view of the documented two-VM lab; not a production SOC architecture.
INTERACTIVE WALKTHROUGH
Try an alert triage scenario
This is a self-contained educational walkthrough with invented examples. It does not query Wazuh, process real logs or reproduce the exact lab rules.
Select a scenario and choose “Review scenario” to see an illustrative triage decision.
03 / VERIFICATION
Evidence and outcomes
Detection-rule definitions, source events and investigation notes are published together.
Correlation tests include negative controls to distinguish expected and unwanted alerts.
Evidence explicitly separates recorded system changes from assumptions about an attacker's intentions.
Selected source-backed examples from the linked repositories. Images are published from already-sanitized source files; report excerpts remain explicitly labelled.
SANITIZED SOURCE SCREENSHOT
Positive detection-control evidence
Cropped manager alert excerpt: rule 100104, Level 10, for a controlled user-discovery and cron-configuration event sequence. One lab observation, not proof of compromise.
How can a correlated alert be distinguished from standalone scheduled-task activity?
Method
The controlled lab observed /usr/bin/id execution followed by monitored cron configuration activity within a 120-second window. A separate cron-only event served as the negative control.
Observed / documented
The positive sequence produced rule 100104 at Level 10. The negative control produced rule 100103 without generating 100104 for that target.
Limits of the evidence
This is one positive and one negative test in an isolated environment. An alert is a triage signal, not proof of compromise or persistence.
