SOC and SIEM with Wazuh

Section 1: The SOC and the Role of the Blue Team

• What a SOC is and the roles of Tier 1 to Tier 3 analysts

• The SOC workflow from detection and triage to analysis and response

• Metrics used to measure SOC work, such as MTTD and MTTR

• Alert fatigue and ways to reduce false positives

• An overview of threats commonly seen by Thai organisations and what a SOC needs to see

Section 2: SIEM, XDR and the Wazuh Architecture

• How SIEM, EDR and XDR differ and how they work together

• Wazuh components: indexer, server, dashboard and agents

• How data travels from an agent through decoders and rules to become an alert

• All-in-one, distributed and Docker deployment options

• Sizing the servers and planning data retention

Section 3: Lab: Installing Wazuh with Docker

• Prepare the host and the system settings the Wazuh indexer needs

• Install a single-node Wazuh deployment with Docker Compose

• Generate certificates and change the default passwords securely

• Explore the Wazuh dashboard: overview, endpoints and modules

• Lab: check service status and fix common installation problems

Section 4: Lab: Deploying Agents on Linux and Windows

• Agent enrolment and how agents communicate with the server

• Install agents on Linux and Windows with the commands the dashboard generates

• Group agents and use centralised configuration through agent.conf

• Check agent status and troubleshoot agents that do not connect

• Lab: bring Linux and Windows machines into the system and view the first events

Section 5: Lab: Collecting Syslog, Windows Events and Sysmon Logs

• Collect log files on Linux and receive syslog from network devices

• Choose the Windows event channels that matter for security

• Install Sysmon with a sensible configuration and forward its events to Wazuh

• Search and filter events in the dashboard with queries and filters

• Lab: track processes and network connections on Windows through Sysmon

Section 6: Wazuh Decoders and Rules

• How decoders are structured and how they extract fields from logs

• How rules are structured: level, group, if_sid and frequency

• Test logs against decoders and rules with wazuh-logtest

• Rule evaluation order and tuning levels to suit the organisation

• Lab: walk through the rules behind a failed SSH login step by step

Section 7: Lab: Writing Custom Decoders and Rules

• Write a decoder for logs from an in-house application

• Write rules that build on existing ones to detect unusual behaviour

• Frequency-based rules for events that repeat within a time window

• Reduce false positives with exceptions and tighter rule conditions

• Lab: detect suspicious logins from the logs of a sample web application

Section 8: Lab: File Integrity Monitoring

• How FIM works and which files and folders are worth watching

• Configure syscheck for scheduled and real-time monitoring

• Find out who changed a file with who-data mode on Linux and Windows

• Monitor the Windows registry keys that attackers use for persistence

• Lab: catch changes to web files and critical configuration files

Section 9: Lab: Vulnerability Detection and SCA

• How vulnerability detection finds CVEs from the software inventory on each machine

• Read vulnerability reports, prioritise by severity and plan patching

• Security Configuration Assessment with policies based on CIS Benchmarks

• Adapt or write SCA policies to match the organisation's own standards

• Lab: assess and harden a Linux machine based on its SCA results

Section 10: MITRE ATT&CK with Wazuh

• How MITRE ATT&CK is organised: tactics, techniques and sub-techniques

• How Wazuh maps rules to ATT&CK techniques

• Use the ATT&CK dashboard to see which techniques appear in the organisation

• Add MITRE IDs to your own custom rules

• Lab: find gaps in detection coverage using the ATT&CK matrix

Section 11: Lab: Active Response

• The idea behind active response and the risks of automated responses

• Use ready-made scripts, such as blocking an IP address with the firewall

• Define the conditions, timeout and target machines for an active response

• Write a simple custom active response script

• Lab: automatically block an IP address that brute forces SSH

Section 12: Lab: Alerting and Integrations

• Send email alerts based on rule level and group

• Connect Wazuh to Slack through its built-in integration

• Write a custom integration that sends alerts to a chat or ticketing webhook

• Design alert levels that keep the team from suffering alert fatigue

• Lab: send important alerts to the SOC team's chat channel

Section 13: Threat Hunting Basics

• The difference between waiting for alerts and proactively hunting for threats

• Build hunting hypotheses from MITRE ATT&CK techniques

• Search for traces in the Wazuh dashboard with queries and visualisations

• Hunt with IOCs such as hashes, IP addresses and domains

• Lab: hunt for suspicious PowerShell activity in Sysmon data

Section 14: Lab: Attack Simulation and Incident Response

• The incident response cycle: preparation, detection, containment, eradication and recovery

• Simulate a brute force attack and a rogue user account on a lab machine

• Simulate dropping a malware test file (EICAR) and follow the detection

• Investigate the incident from its alerts and build an attack timeline

• Write an incident response playbook for common incidents

Section 15: Workshop: SOC Simulation Capstone

• Act as the SOC team to detect and analyse a series of attacks staged by the instructor

• Triage alerts, separate out false positives and assess severity

• Contain the incident with active response and the measures in the playbook

• Write an incident report with recommendations to improve detection

• A checklist for taking Wazuh into production in your organisation