Lab 1.1 — Alert Trace

Lab Overview

Part 1: Log into the Wazuh Dashboard

When you click Start Lab, a cloud environment with Wazuh will spin up in about 30 seconds. You'll receive a direct link to the Wazuh Dashboard — click it to open it in your browser.

Step 1: Access the Dashboard

Click the lab link to open the Wazuh Dashboard in your browser.

Credentials:

• Username: admin
• Password: SecretPassword

Step 2: Orient Yourself

Once logged in, take 2 minutes to scan the interface. Don't click anything yet — just read.

Part 2: Understand Alert Severity

Before tracing specific alerts, you need to understand the severity system. Wazuh assigns every alert a severity level that determines how urgently it needs attention.

Step 3: Review the Severity Scale

Navigate to Modules → Security Events (or click "Security Events" on the main dashboard). You'll see a list of alerts. Each has a severity level:

Step 4: Examine One Alert from Each Level

Click into the alert list and find one alert from each severity level (Critical/High, Medium, Low). For each, read the full alert details and note:

• The rule name (what triggered the alert)
• The severity level (the number)
• The timestamp (when it happened)

This gives you a feel for the range of events a SOC sees — from routine noise to genuine threats.

Part 3: Trace the Alert Data Flow

This is the core exercise. You're going to pick three specific alerts and trace each one backward through the pipeline to understand exactly how data flows from an endpoint to the screen in front of you.

Click to enlarge

The Six-Stage Pipeline

Every alert you see traveled through this exact path:

Understanding this pipeline is fundamental. When you look at an alert and ask "where did this come from?" — you're mentally walking backward through stages 4 → 3 → 2 → 1.

Step 5: Trace Alert #1 — A Failed Login

Find an alert related to failed authentication. Look for rule names containing "authentication failure," "failed logon," or Windows Event ID 4625.

Click the alert to expand its full details. Now answer these questions — write them down in your Alert Trace Worksheet:

Step 6: Trace Alert #2 — A New Service Installed

Find an alert related to a new service or process being installed. Look for rule names mentioning "new service," "service installed," or Windows Event ID 7045.

Complete the same worksheet. Add two extra questions:

Step 7: Trace Alert #3 — A File Integrity Change

Find an alert related to file integrity monitoring (FIM). Wazuh monitors critical system files and alerts when they change. Look for rules mentioning "integrity" or "syscheck."

Complete the same worksheet. Add two extra questions:

Part 4: Connect the Dots

Now that you've traced three individual alerts, zoom out and think about the bigger picture.

Step 8: Map the Data Flow

Without looking at the diagram above, draw or write out the 6-stage pipeline from memory:

Stage 1: __________ → Stage 2: __________ → Stage 3: __________
→ Stage 4: __________ → Stage 5: __________ → Stage 6: __________

If you can fill this in correctly, you understand the fundamental architecture of how a SIEM works. This knowledge applies to every SIEM — not just Wazuh. Splunk, QRadar, Elastic SIEM, and Microsoft Sentinel all follow the same basic pattern.

Step 9: Reflect on Your Traces

Look at your three completed worksheets side by side. Answer:

1. Which alert would you investigate first? Why?
2. Could any of these alerts be related? (e.g., failed login → new service → file change = possible attack chain)
3. What additional information would you want to investigate each alert further?

Deliverables Checklist

Before marking this lab complete, verify you have:

• Alert Trace #1 — Failed login alert fully traced with all 6 questions answered
• Alert Trace #2 — New service alert fully traced with all 8 questions answered
• Alert Trace #3 — File integrity alert fully traced with all 8 questions answered
• Data Flow Memory Test — You can write the 6-stage pipeline from memory
• Reflection — You answered the three reflection questions connecting your traces

What's Next

In Lab 1.2 — ATT&CK Mapping, you'll take a real-world APT29 attack report and map every technique to the MITRE ATT&CK framework using the free ATT&CK Navigator. This is a browser-only exercise — no cloud lab needed. You'll identify which techniques from the attack could be detected by the alerts you just traced, and where the detection gaps are.