TS TOMEK.ST
Search PL Contact Write
SOC

Wazuh as a starting point for SIEM

From an endpoint log to an alert you can keep or close. Wazuh in a lab, not on a slide.

Tomek 7 min read BEGINNER

Wazuh in the lab exists so you can see how an alert is born, not so you can pretend it is an enterprise platform.

Before you write a clever rule, answer:

  1. where the log comes from
  2. how it reaches the manager
  3. what survives the decoder
  4. when an alert fires
  5. what the analyst sees
  6. how to replay it or close it as FP

SIEM does not replace triage. The rule-review template is in Resources — an empty field means “do not enable”.

Want this in a lab or in production?

The article stays free. The form is for scope, not a paywall.

I usually reply within 1 business day. The inquiry is stored on the server; you get a confirmation from hello@tomek.st. Sending does not commit you to a contract.

RELATED / CONTENT

Related content

PRODUCTS

SOC L1 Home Lab Checklist (product)

An extended paid SOC L1 lab checklist — in preparation. The free version lives under Resources.

 RESOURCES

Wazuh rule review template

Before you enable a rule: condition, test, false positive, owner.

 SERVICES

Cybersecurity

Practical cybersecurity: hardening, logging, exposure review and monitoring that supports decisions — for organisations and individuals.
Discuss this in your environment ← Back to research