How jaopadua/siem-threat-detection-lab works
This repository documents a Wazuh security-monitoring lab: endpoint detections and integrity changes are collected and categorized into alerts, with Telegram notifications as a user-facing result. The README also describes Suricata, agent deployment, and a dashboard. No source excerpts were provided, so the graph reflects documented configuration and relationships only; it does not assert undocumented implementation details.
Main entry points: README.md Wazuh Manager
Components 11
Endpoint Detection
- ClamAV Scanning
README.md - Detection Log
README.md - Agent Collection
README.md - File Integrity Monitoring
README.md - Suricata IDS
README.md
Wazuh Monitoring
- Wazuh Manager
README.md - Custom Rules
README.md - Agent Dashboard
README.md
Alert Delivery
- Telegram Integration
README.md
Other components
- Security Activity
- Telegram Bot
Connections 11
- Security Activity → ClamAV Scanning: scanned by
README.md - ClamAV Scanning → Detection Log: writes detections
README.md - Detection Log → Agent Collection: read by
README.md - Agent Collection → Wazuh Manager: sends events
README.md - Security Activity → File Integrity Monitoring: monitored for changes
README.md - File Integrity Monitoring → Wazuh Manager: reports changes
README.md - Security Activity → Suricata IDS: inspected by
README.md - Wazuh Manager → Custom Rules: evaluates events with
README.md - Custom Rules → Telegram Integration: categorizes alerts for
README.md - Telegram Integration → Telegram Bot: sends notifications
README.md - Agent Dashboard → Wazuh Manager: deploys agents through
README.md