SOC and SIEM with Wazuh is a hands-on Blue Team course in building security monitoring with Wazuh, from a Docker install and log collection on Linux, Windows and Sysmon to custom detection rules, FIM, MITRE ATT&CK mapping, active response and threat hunting. It suits system administrators, IT security teams and junior SOC analysts, and you leave with an incident response playbook for your organisation.
Many organisations already have firewalls and antivirus, yet they still cannot see what is happening on their own machines and servers from day to day. Logs are scattered in many places and nobody looks at them until something breaks, so when a real incident happens nobody knows how the attacker got in or what they have already done. The job of a Blue Team and a SOC is to make these events visible early and respond before the damage spreads.
This course has learners build their own security monitoring system with Wazuh, an open source SIEM and XDR platform. It starts with the roles and workflow of a SOC, then installs the Wazuh indexer, server and dashboard with Docker, deploys agents on Linux and Windows and collects logs from syslog, Windows events and Sysmon. Learners then write their own decoders and rules and work with File Integrity Monitoring, vulnerability detection, Security Configuration Assessment and MITRE ATT&CK mapping, before moving on to active response, alerting, threat hunting and attack simulations that are handled with an incident response playbook. It closes with a capstone in which learners act as the SOC team through a full incident. (3 days, 6 hours per day, 18 hours in total, Intermediate level.)
Course Details
This is a Blue Team security course focused on monitoring, detecting and responding to threats with Wazuh. It runs for 3 days, 6 hours per day (18 hours in total, 09:00-16:00), as lectures with labs on a SOC lab that learners build themselves on their own machines with Docker. Intermediate level. All tools are open source or free to use, and attack simulations are run only against authorised lab machines. The course complements ethical hacking courses that focus on the attacking side, and it does not cover large clustered Wazuh deployments for production. Learners take home a lab guide, docker-compose files, a set of sample rules and decoders, and an incident response playbook template.
Section 1: The SOC and the Role of the Blue Team
What a SOC is and the roles of Tier 1 to Tier 3 analysts
The SOC workflow from detection and triage to analysis and response
Metrics used to measure SOC work, such as MTTD and MTTR
Alert fatigue and ways to reduce false positives
An overview of threats commonly seen by Thai organisations and what a SOC needs to see
Section 2: SIEM, XDR and the Wazuh Architecture
How SIEM, EDR and XDR differ and how they work together
Wazuh components: indexer, server, dashboard and agents
How data travels from an agent through decoders and rules to become an alert
All-in-one, distributed and Docker deployment options
Sizing the servers and planning data retention
Section 3: Lab: Installing Wazuh with Docker
Prepare the host and the system settings the Wazuh indexer needs
Install a single-node Wazuh deployment with Docker Compose
Generate certificates and change the default passwords securely
Explore the Wazuh dashboard: overview, endpoints and modules
Lab: check service status and fix common installation problems
Section 4: Lab: Deploying Agents on Linux and Windows
Agent enrolment and how agents communicate with the server
Install agents on Linux and Windows with the commands the dashboard generates
Group agents and use centralised configuration through agent.conf
Check agent status and troubleshoot agents that do not connect
Lab: bring Linux and Windows machines into the system and view the first events
Section 5: Lab: Collecting Syslog, Windows Events and Sysmon Logs
Collect log files on Linux and receive syslog from network devices
Choose the Windows event channels that matter for security
Install Sysmon with a sensible configuration and forward its events to Wazuh
Search and filter events in the dashboard with queries and filters
Lab: track processes and network connections on Windows through Sysmon
Section 6: Wazuh Decoders and Rules
How decoders are structured and how they extract fields from logs
How rules are structured: level, group, if_sid and frequency
Test logs against decoders and rules with wazuh-logtest
Rule evaluation order and tuning levels to suit the organisation
Lab: walk through the rules behind a failed SSH login step by step
Section 7: Lab: Writing Custom Decoders and Rules
Write a decoder for logs from an in-house application
Write rules that build on existing ones to detect unusual behaviour
Frequency-based rules for events that repeat within a time window
Reduce false positives with exceptions and tighter rule conditions
Lab: detect suspicious logins from the logs of a sample web application
Section 8: Lab: File Integrity Monitoring
How FIM works and which files and folders are worth watching
Configure syscheck for scheduled and real-time monitoring
Find out who changed a file with who-data mode on Linux and Windows
Monitor the Windows registry keys that attackers use for persistence
Lab: catch changes to web files and critical configuration files
Section 9: Lab: Vulnerability Detection and SCA
How vulnerability detection finds CVEs from the software inventory on each machine
Read vulnerability reports, prioritise by severity and plan patching
Security Configuration Assessment with policies based on CIS Benchmarks
Adapt or write SCA policies to match the organisation's own standards
Lab: assess and harden a Linux machine based on its SCA results
Section 10: MITRE ATT&CK with Wazuh
How MITRE ATT&CK is organised: tactics, techniques and sub-techniques
How Wazuh maps rules to ATT&CK techniques
Use the ATT&CK dashboard to see which techniques appear in the organisation
Add MITRE IDs to your own custom rules
Lab: find gaps in detection coverage using the ATT&CK matrix
Section 11: Lab: Active Response
The idea behind active response and the risks of automated responses
Use ready-made scripts, such as blocking an IP address with the firewall
Define the conditions, timeout and target machines for an active response
Write a simple custom active response script
Lab: automatically block an IP address that brute forces SSH
Section 12: Lab: Alerting and Integrations
Send email alerts based on rule level and group
Connect Wazuh to Slack through its built-in integration
Write a custom integration that sends alerts to a chat or ticketing webhook
Design alert levels that keep the team from suffering alert fatigue
Lab: send important alerts to the SOC team's chat channel
Section 13: Threat Hunting Basics
The difference between waiting for alerts and proactively hunting for threats
Build hunting hypotheses from MITRE ATT&CK techniques
Search for traces in the Wazuh dashboard with queries and visualisations
Hunt with IOCs such as hashes, IP addresses and domains
Lab: hunt for suspicious PowerShell activity in Sysmon data
Section 14: Lab: Attack Simulation and Incident Response
The incident response cycle: preparation, detection, containment, eradication and recovery
Simulate a brute force attack and a rogue user account on a lab machine
Simulate dropping a malware test file (EICAR) and follow the detection
Investigate the incident from its alerts and build an attack timeline
Write an incident response playbook for common incidents
Section 15: Workshop: SOC Simulation Capstone
Act as the SOC team to detect and analyse a series of attacks staged by the instructor
Triage alerts, separate out false positives and assess severity
Contain the incident with active response and the measures in the playbook
Write an incident report with recommendations to improve detection
A checklist for taking Wazuh into production in your organisation
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
A SIEM collects logs from many systems in one place to analyse them and raise alerts. EDR monitors and responds on endpoints, watching processes and files on each computer. XDR extends detection by correlating data across layers such as endpoints, network and cloud. Wazuh combines SIEM and XDR capabilities in a single open-source platform.
First check whether a decoder already extracts the fields from the log; if not, write a custom decoder. Then add the rule to local_rules.xml with an id, a level and its conditions, for example building on an existing rule with if_sid or counting repeated events with frequency and timeframe. Test it with wazuh-logtest before restarting the manager, and add a MITRE ID to the rule.
File integrity monitoring (FIM) watches important files and folders by recording their checksums and attributes and raising an alert when a file is added, changed or deleted. In Wazuh it is configured through syscheck, either on a schedule or in real time, and who-data mode shows which user or process made the change. Typical targets are system configuration files, web files and the Windows registry.
It suits system and network administrators responsible for security, junior SOC analysts and people moving into blue team work, and IT security teams that want an open-source SIEM. You should handle the Linux command line and Windows at a basic administrator level, understand networking basics such as IP addresses, ports and DNS, and know common threats such as malware and brute force attacks.
You will be able to install Wazuh and agents on Linux and Windows, collect Syslog, Windows event and Sysmon logs, write custom detection rules, use FIM and vulnerability detection to find weak points, set up active response to block IP addresses automatically, and handle incidents with a playbook you have written. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.
Bring a laptop with at least 16 GB of RAM that can run Docker Desktop or VirtualBox, with administrator rights, because you build a simulated SOC lab on your own machine with Docker and a single-node Wazuh install. You take home the docker-compose file, sample rules and decoders, and an incident response playbook template.
Development teams now ship code to production several times a day with CI/CD, yet much of the security work still waits for a final check just before release. Vulnerabilities are found late, when they are hard and expensive to fix, or they slip into…
An organization can only defend well when it understands how attackers think and operate. This course teaches ethical penetration testing following a standard methodology: defining scope and obtaining written authorization, reconnaissance, scanning and…
Plenty of organizations get asked by a customer or partner for ISO/IEC 27001 certification, then discover the standard is hard to read, full of specialist vocabulary and never states plainly what the organization has to do. Many respond by hiring a consultant…
