Wazuh SIEM: Log Analysis & Detection Engineering
An enterprise-grade detection home lab modeling end-to-end SOC Analyst and Detection Engineering operations. Built an isolated VirtualBox environment featuring Wazuh 4.14.6 (all-in-one Manager, Indexer, and Dashboard), an instrumented Ubuntu Server 24.04 endpoint, and a dedicated Kali Linux attacking node. Generated adversarial SSH brute-force traffic using parallel Hydra attacks and custom sequential automation scripts. Authored and tuned custom correlation rule 100002 to suppress default noise and accelerate detection speed by 37.5%, followed by automated host containment through Wazuh Active Response via iptables with automated 600-second timeout recovery.
Achieved 37.5% faster brute-force detection over Wazuh defaults (5 vs 8 failed attempts), 100% alert verification accuracy across 50 attack runs, and sub-second automated host isolation via iptables Active Response.
Key Metrics & Measurable Impact
Empirical telemetry collected across attack simulations, custom correlation rule tuning, and automated containment runs.
5 attempts (custom rule 100002) vs 8 attempts (default Wazuh 5712)
6 alerts verified consistently across 30 attempts (30 / 5 = 6)
Infrastructure, agent ingestion, attack simulation, rule tuning, and active response
Authentication-failure events evaluated during noise rule suppression
Parallel Hydra simulations (-t 16) and sequential sshpass scripts
Technical screenshots across 6 evidence folders and 9 markdown reports
Work Artifacts & Key Evidence
Selected technical screenshots and logs. Use the side arrows to scroll or click any card to inspect.
Full Detection Chain in Dashboard
End-to-end detection timeline in Wazuh Dashboard: initial noisy rule triggers, custom correlation rule suppression, and automated Active Response host containment in a unified workflow.
Custom Detection Rule Trigger
Custom correlation rule (ID 100002) successfully fired following threshold tuning (lowered from 8 to 5) and parent SID logic validation.
Active Response Containment (iptables)
Technical verification of automated host isolation: malicious attacker IP dropped directly via iptables firewall rule with automated 600s expiration.
Wazuh Dashboard Overview
Initial landing view of Wazuh Dashboard confirming healthy single-node cluster status and operational services post-installation.
Endpoint Log Forwarding Active
Linux endpoint successfully enrolled and active, validating the end-to-end secure log ingestion and forwarding pipeline over TCP 1514.
Investigation Timeline
Infrastructure Deployment & Resource Tuning
Deployed Wazuh 4.14.6 Manager, Indexer, and Dashboard all-in-one on Ubuntu Server 24.04 LTS (192.168.56.104). Overcame indexer resource lockups by reallocating VM specs to 8 GB RAM and 4 vCPUs.
Adversarial Simulation via Hydra & SSHPass
Generated structured attack traffic from Kali Linux (192.168.56.102) against target endpoint (192.168.56.106) using Hydra (-t 16, 40 attempts) and sequential sshpass scripts (10 attempts).
Custom Correlation Rule & Threshold Optimization
Engineered custom rule 100002 matching non-existent user login failures (if_matched_sid: 5710) with frequency=5 in 120s. Resolved rule redundancy where default rule 5712 previously consumed the event window.
Active Response Containment & Verification
Validated active response command firewall-drop triggering active iptables DROP rules against attacker IP with a 600-second auto-unblock timeout. Verified mathematically: 30 attempts / 5 threshold = exactly 6 fired alerts.
Implementation Phases & Checklist
- ✓Provision 3 VirtualBox VMs (Manager, Linux endpoint, Kali Linux)
↳ Dual-adapter NAT + Host-only 192.168.56.0/24
- ✓Install Ubuntu Server 24.04 LTS (unattended installation)
- ✓Troubleshoot VirtualBox PXE boot loop order issue
- ✓Configure SSH remote administration from Windows Terminal
- ✓Install Wazuh all-in-one stack (Manager, Indexer, Dashboard 4.14.6)
- ✓Resolve indexer resource lockup by upgrading VM to 8 GB RAM and 4 vCPUs
- ✓Deploy Linux endpoint VM and install Wazuh Agent
- ✓Resolve WAZUH_MANAGER environment variable reset under sudo
- ✓Verify agent active status and live auth.log telemetry pipeline
- ✓Validate Threat Hunting dashboards, SCA, Vulnerability Detection, and MITRE mapping
- ✓Execute parallel SSH brute-force attack via Hydra (-t 16, 40 attempts)
- ✓Execute sequential SSH brute-force simulation via sshpass script (10 attempts)
- ✓Compare attack telemetry signatures and fired rules across both methods
- ✓Analyze ~1,984 authentication-failure telemetry events
- ✓Assess alert fatigue on default rule 5710 (authentication failure)
- ✓Author custom correlation rule 100002 in local_rules.xml
- ✓Debug if_sid vs if_matched_sid logic for multi-attempt correlation
- ✓Tune frequency threshold from 8 to 5 to outpace default rule 5712 (37.5% faster)
- ✓Validate rule syntax and evaluation logic with wazuh-logtest
- ✓Recover from Wazuh Manager database corruption (wazuh-db reset)
- ✓Verify custom rule trigger in Dashboard against live attack traffic (6 alerts from 30 attempts)
- ✓Configure Active Response firewall-drop tied to custom Rule 100002
- ✓Validate automated host containment (iptables DROP target) against attacker IP
- ✓Verify automated unblock recovery after 600s timeout and manual CLI release
- ✓Produce blue-team Incident Report (IOC, Timeline, Root Cause, Remediation)
- ✓Draft SOC Containment Playbook and Detection Rule specifications
- ◐Organize repository structure and prepare local documentation assets
↳ Assets verified, repository restructuring in progress
- ○Integrate Windows endpoint agent and simulate RDP brute-force vectors
- ○Implement File Integrity Monitoring (FIM) and Linux SSH hardening
Documentation & Technical Reports
This project was developed strictly for cybersecurity research, defense engineering, and professional portfolio demonstration. All adversarial simulations were executed within an isolated, self-hosted virtual lab network (VirtualBox Host-only subnet) targeting owned assets exclusively, without interaction with any third-party infrastructure.