SOC L1 Home Lab: environment architecture
A light L1 lab: host, two endpoints, a collector. The data path matters more than the tool pile.
Research & Blog
Technical articles, laboratories, research, tutorials and analysis covering IT, cybersecurity and digital forensics.
Wazuh as a starting point for SIEM
From an endpoint log to an alert you can keep or close. Wazuh in a lab, not on a slide.
Windows Event Logs for SOC L1
Source and context beat a memorised number. Security, process, PowerShell — if audit is even on.