PROBLEM
SOC theory with no place to generate an event, see a log and write a decision.
PODEJŚCIE
A rebuildable lab where event → log → alert → note actually runs.
ARCHITECTURE
- lab host with virtualisation
- Windows endpoint
- Linux endpoint
- collector / Wazuh
IMPLEMENTATION
- host baseline
- agents / logs
- a few test scenarios
- run notes
RESULT
- a defined log path in the lab
- a build checklist (resource on this site)
- exercise notes, not client metrics
LESSONS
- fewer tools, working chain
- without notes the lab drifts
Goal
Build an environment where an L1 exercise is repeatable: event, log, decision, note. This is not a company SOC and not a case study with invented hours saved.
Two problems I solved
1. Theory without telemetry
I could read ATT&CK and alert write-ups, but I had no place to generate an event and see it land in a log. “Triage” was guessing from an article.
What I gained: a working event → log → alert → note chain on my own hosts. I know which Event IDs and sources actually reach the collector — before writing rules.
2. A lab that drifted after a week
I kept adding tools “just in case”. After reboot it was unclear what was source of truth, which agent was alive, and where the exercise note lived.
What I gained: a narrow baseline (Windows + Linux + Wazuh), a build checklist, and the habit of ending each exercise with a note, not a screenshot. Fewer dashboards, more repeatability.
Lab shape
- Virtualisation host and a network isolated from production.
- Windows and Linux endpoints with lab accounts.
- Agent / collector (Wazuh) and an explicit log path.
- A test scenario (failed logon, new service) plus a short decision note.
ATT&CK mapping is added only where the log actually covers the technique — not for decoration.
Related material
- SOC L1 lab architecture
- First note after an alert
- Windows Event Log cheat sheet
- Wazuh SIEM in the portfolio
Boundaries
The lab is not a public service, does not monitor someone else’s production, and is not a 24/7 SOC. This site’s GitHub repo is not a VM image repo.
Status
active: the lab is being extended. Extra tools wait until the basic pipeline works.