Module 2: SIEM Mastery — Eyes on Everything
The SIEM is your command center. Master it.
11 lessons · 9 labs
The same activity shows up across more log sources. Practice reading alerts and queries; the campaign name comes later.
Path
- Lesson01
Lesson 2.1 — Wazuh Architecture: How Your SIEM Works
Manager, Indexer, Dashboard — understand every component, how agents connect, and how data flows through your SIEM
- Lab02Beginner
Lab 2.1 — Alert Anatomy
Open ten real alerts and trace each field back to the pipeline stage that wrote it — agent, decoder or rule engine — and build a Field Map for every later lab.
- Lesson03
Lesson 2.2 — Log Sources That Matter
The 8 log source categories every SOC monitors: Windows Event Logs, Linux/Syslog, firewall, DNS, web proxy, email gateway, cloud audit trails, and application logs
- Lab04Beginner
Lab 2.2 — Log Source Deep Dive
Read one event from each of five log sources field by field — SSH, firewall, Windows logons, web access and DNS. Hold raw logs against parsed fields, decode a Windows failure reason, and see how the same field name means different things on different sources.
- Lesson05
Lesson 2.3 — From Raw Log to Alert: The Detection Pipeline
Trace a log from agent to alert — pre-decoder, decoder, rule engine, indexer, dashboard
- Lab06Intermediate
Lab 2.3 — Trace the Pipeline
Trace 3 real alerts from raw log to structured alert — SSH, Windows, and firewall — documenting every pipeline stage.
- Lesson07
Lesson 2.4 — Decoders (Parsers): How Logs Become Fields
Pre-decoder, parent, and child decoders — how Wazuh extracts structured fields from raw logs
- Lesson08
Lesson 2.5 — Rules: How Alerts Are Born
Rule types, levels, groups, MITRE mapping, and how to read Wazuh rule XML
- Lab09Intermediate
Lab 2.4 — Read the Rule
Read and analyze 5 Wazuh rule XML definitions — understand detection logic, thresholds, parent-child chains, and evasion techniques for each rule.
- Lesson10
Lesson 2.6 — Anatomy of a SIEM Alert
Rule ID, severity, source fields
- Lesson11
Lesson 2.7 — Search & Correlation
Query syntax, filtering, correlation
- Lab12Intermediate
Lab 2.5 — Hunt by Query
Write 6 targeted threat-hunting queries using DQL (Dashboard Query Language) — brute force, success indicators, SQL injection, privilege escalation, encoded payloads — then run your first real hunt by stacking a field on frequency and chasing the rare value that matters.
- Lesson13
Lesson 2.8 — CDB Watchlists and MISP Threat Intelligence
How Wazuh matches events against a MISP watchlist and how the MISP integration raises a separate intel alert you correlate back to the detection
- Lab14Intermediate
Lab 2.6 — Correlate Threat-Intel Alerts
Find the MISP intel alerts, follow each back to the detection it names, and prove where threat intelligence falls silent.
- Lesson15
Lesson 2.9 — Dashboards & Visualizations
Building security dashboards
- Lab16Intermediate
Lab 2.7 — Build a SOC Dashboard
Build 4 operational dashboard panels — severity distribution, agent heat map, top attackers, and attack timeline — and assemble them into a SOC Morning Standup Dashboard.
- Lesson17
Sysmon: The Endpoint Telemetry Goldmine
Deploy Sysmon, understand its 29 event types, and close the detection gaps identified in Module 1
- Lab18Intermediate
Lab 2.8 — Sysmon Visibility Boost
Compare standard Windows logging with Sysmon's richer telemetry. Analyze process creation, network connections, file creation, registry, LSASS-access and DNS events to build a visibility assessment.
- Lesson19
File Integrity Monitoring: Catching Changes to Critical Files
How Wazuh's syscheck engine baselines and watches critical files — rule family 550/553/554, realtime vs scheduled scans, tuning, and FIM's role in the attack timeline
- Lab20Intermediate
Lab 2.9 — FIM Hunt
Walk the file-integrity trail on linux-web-01 after its SSH intrusion — a deleted rotated log, a truncated authentication log hidden in the archives, a 33-byte sudoers append — and watch the ransomware's burst of files on WIN-FS-01's finance share through FIM alone.