How zayan9484/soc-detection-engineering works
This repository documents a controlled SOC detection engineering lab, not a standalone software application. Its principal workflow is to generate simulated activity, collect network and endpoint telemetry, detect or correlate events in Suricata and Wazuh, then investigate alerts and document validation and remediation. The graph includes the README’s network, authentication, FIM, and Sysmon detection branches. Relationships reflect documented data flow; implementation details beyond the supplied tree and documentation are not inferred.
Main entry points: investigations Alert Investigations · scenarios Network Traffic · 03-ssh-bruteforce-detection.md Linux Auth Logs · 04-windows-bruteforce-detection.md Windows Security Events
Components 18
Lab Activity
- Kali Simulator
- Ubuntu Endpoint
- Windows Endpoint
Telemetry Collection
- Network Traffic
scenarios - Linux Auth Logs
scenarios/03-ssh-bruteforce-detection.md - Windows Security Events
scenarios/04-windows-bruteforce-detection.md - FIM Configuration
configs/windows-fim-config.xml - Sysmon Wazuh Configuration
configs/windows-sysmon-wazuh-config.xml
Detection Analysis
- Suricata IDS
- Custom Suricata Rules
detection-rules/suricata-local.rules - Sysmon
- Wazuh SIEM
- Custom Wazuh Rules
detection-rules/wazuh-windows-rules.xml
Investigation Results
- SOC Analyst
- Alert Investigations
investigations - Scenario Validation
scenarios - Detection Summary
results/detection-summary.md - Remediation Analysis
investigations
Connections 21
- Kali Simulator → Ubuntu Endpoint: simulates activity
- Ubuntu Endpoint → Network Traffic: generates
- Windows Endpoint → Network Traffic: generates
- Ubuntu Endpoint → Linux Auth Logs: records logons
- Windows Endpoint → Windows Security Events: records logons
- Network Traffic → Suricata IDS: monitored by
- Custom Suricata Rules → Suricata IDS: defines signatures
- Suricata IDS → Wazuh SIEM: forwards alerts
- Linux Auth Logs → Wazuh SIEM: provides telemetry
- Windows Security Events → Wazuh SIEM: provides telemetry
- Windows Endpoint → Sysmon: provides process events
- Sysmon → Wazuh SIEM: forwards telemetry
- Sysmon Wazuh Configuration → Wazuh SIEM: configures collection
- FIM Configuration → Wazuh SIEM: configures FIM
- Custom Wazuh Rules → Wazuh SIEM: defines correlation
- Wazuh SIEM → SOC Analyst: presents alerts
- SOC Analyst → Alert Investigations: investigates alerts
- SOC Analyst → Scenario Validation: validates detections
- Alert Investigations → Remediation Analysis: informs
- Scenario Validation → Detection Summary: documents outcomes
- Alert Investigations → Detection Summary: summarized in