nnam099/enterprise-soc-detection-ir-lab

This repository is a defensive SOC lab spanning Windows telemetry collection, Wazuh detections, threat-hunting evidence, and incident response. The main workflow follows endpoint activity into SIEM alerts, then analyst investigation and case timelines. It also documents lab topology, detection validation, and the distinction between independent validation events and confirmed incident evidence. The DFIR scripts show the evidence-to-timeline transformation; other subsystem links are included only where the README documents them, since most supporting files were not sampled.