Mini SOC Lab (Wazuh SIEM)

I’ve spent the last few days diving deep into the Blue Team side of cybersecurity by building a dedicated Security Operations Center (SOC) Lab to simulate, detect, and analyze real-world attacks.

🔧 Lab Setup Setting up the environment was a lesson in systems architecture. I utilized VirtualBox to create an isolated network consisting of: - The Brain: Wazuh Manager, Indexer, and Dashboard. - The Target: An Ubuntu Server (monitored endpoint). - The Attacker: Kali Linux.

🧪 Attack & Detection Scenarios I simulated several techniques and mapped them to the MITRE ATT&CK® framework: - Brute Force (T1110): Used Hydra to simulate SSH credential stuffing. - Privilege Escalation (T1548.003): Monitored suspicious sudo activity. - Valid account authentication events (T1078): Suspicious network service using Netcat Seeing these attacks move from raw logs to actionable alerts on the Wazuh Dashboard made the concept of "Detection Engineering" feel much more real.

⚙️ Challenges & Lessons Learned Setting up the lab was not entirely straightforward. I ran into several networking issues when configuring VirtualBox adapters (NAT vs Host-Only vs Internal Network), which initially caused connectivity problems between the attacker, monitored machine, and the Wazuh server. Troubleshooting these helped me better understand how isolated lab networks work and why proper network configuration is critical for security monitoring environments.

I also learned how SIEM systems rely heavily on log sources, if the endpoint logs are not generated or properly forwarded, detections will not occur even if an attack is happening.

This lab helped me understand the critical importance of log integrity and the complexity of maintaining a secure monitoring environment.