Home LabOperational

Wazuh Detection Home Lab

This home lab turns documentation into evidence. It combines deliberately instrumented endpoints, a segmented virtual network, and a defined attack-simulation routine so each detection can be validated against the logs it is expected to produce.

Project signal

4 zones

identity, user, server, analyst

Core stack

Wazuh · Sysmon · Windows Event Forwarding · Ubuntu

Architecture

A deliberate path from signal to decision.

Endpoints

Windows workstations and Linux servers emit process, authentication, file, and network telemetry.

Collection

Wazuh agents, Sysmon, and network sensors forward consistently tagged events into the manager.

Analysis

Dashboards and saved investigations validate use cases against atomic attack simulations.

Capabilities

What the project is designed to make easier.

Documented build steps make the lab reproducible after a rebuild or configuration experiment.
Endpoint baselines distinguish normal administrative activity from truly unusual behavior.
Atomic simulations create known-good test cases for credential access, persistence, and discovery detections.
Network segmentation keeps experiments isolated while still allowing meaningful east-west telemetry.

Operational views

The evidence an operator should be able to see.

These interface snapshots define the key evidence surfaces for the project. They are intentionally designed around investigation context rather than decorative dashboards.

Endpoints context

Windows workstations and Linux servers emit process, authentication, file, and network telemetry.

Collection context

Wazuh agents, Sysmon, and network sensors forward consistently tagged events into the manager.

Analysis context

Dashboards and saved investigations validate use cases against atomic attack simulations.

Engineering challenges

Balancing enough logging for detection confidence against limited homelab resources.
Preventing overly broad rules from teaching the wrong lesson about alert quality.
Maintaining a clean reset path after intrusive simulations.

Lessons carried forward

A lab is most valuable when every experiment begins with a detection hypothesis.
Windows event collection needs explicit validation; assumed logging is a common blind spot.
Attack simulations should leave behind a clear evidence trail that another analyst can reproduce.

Roadmap

Future improvements

Add automated baseline comparisons after operating system or agent upgrades.
Introduce a small Active Directory environment for identity-focused detections.
Export validated rules to a portable Sigma rule pack.

Continue exploring

Related security work

In development

SOC Engineering

SentinelOPS

A detection-first SOC operations workspace that brings telemetry health, triage context, and response playbooks into one deliberate workflow.

PythonFastAPISigma+3

Explore project

In development

Detection Engineering

Detection Engineering Workbench

A practical rule-development workflow that connects hypotheses, sample telemetry, test cases, and release decisions.

SigmaGitHub ActionsPython+3

Explore project

Operational

Threat Hunting

Threat Hunting Playbook

A hypothesis-led investigation framework for turning ATT&CK-informed questions into repeatable hunts and measurable improvements.

MITRE ATT&CKKQLSigma+3

Explore project

A deliberate path from signal to decision.

Endpoints

Windows workstations and Linux servers emit process, authentication, file, and network telemetry.

Collection

Wazuh agents, Sysmon, and network sensors forward consistently tagged events into the manager.

Analysis

Dashboards and saved investigations validate use cases against atomic attack simulations.

What the project is designed to make easier.

Documented build steps make the lab reproducible after a rebuild or configuration experiment.

Endpoint baselines distinguish normal administrative activity from truly unusual behavior.

Atomic simulations create known-good test cases for credential access, persistence, and discovery detections.

Network segmentation keeps experiments isolated while still allowing meaningful east-west telemetry.

The evidence an operator should be able to see.

These interface snapshots define the key evidence surfaces for the project. They are intentionally designed around investigation context rather than decorative dashboards.

Endpoints context

Windows workstations and Linux servers emit process, authentication, file, and network telemetry.

Collection context

Wazuh agents, Sysmon, and network sensors forward consistently tagged events into the manager.

Analysis context

Dashboards and saved investigations validate use cases against atomic attack simulations.

Related security work

In development

SOC Engineering

SentinelOPS

A detection-first SOC operations workspace that brings telemetry health, triage context, and response playbooks into one deliberate workflow.

PythonFastAPISigma+3

Explore project

In development

Detection Engineering

Detection Engineering Workbench

A practical rule-development workflow that connects hypotheses, sample telemetry, test cases, and release decisions.

SigmaGitHub ActionsPython+3

Explore project

Operational

Threat Hunting

Threat Hunting Playbook

A hypothesis-led investigation framework for turning ATT&CK-informed questions into repeatable hunts and measurable improvements.

MITRE ATT&CKKQLSigma+3

Explore project