PROBLEM
SIEM is installed, but the analyst cannot tell where the alert came from or how to reproduce it.
PODEJŚCIE
Understand and document the path: endpoint → agent → parser → rule → alert.
ARCHITECTURE
- Wazuh manager in the lab
- agents on Windows and Linux
- a few rules with an explicit test
IMPLEMENTATION
- lab install
- first endpoint logs
- one rule with a positive test and a false trail
RESULT
- pipeline described in docs and on the blog
- rule-review template as a resource
- no client “MTTD” metrics — they do not exist here
LESSONS
- a rule without a test is decoration
- alert ≠ incident
Goal
Wazuh in this portfolio is a SIEM lab: it shows how an alert is born, not that “I deployed Wazuh at company X”.
Two problems I solved
1. Alerts with no reverse path
I had a green dashboard and no certainty whether an alert came from a rule, a decoder, or noise. I could not reproduce it.
What I gained: a documented endpoint → agent → parser → rule → alert path. I can point to which rule file and which log field decide a hit — or a miss.
2. Rules written “by eye”
I added detections without a positive test and without a false trail. After a week I did not know which rules were dead.
What I gained: the habit of one rule with an explicit hit/miss test and a rule-review template. An alert is a hypothesis to verify, not a verdict.
What I practise
- manager and Windows/Linux agents in isolation,
- first Event Logs and syslog in the index,
- one rule with ATT&CK mapping only when the log covers the technique,
- a note: true positive, false positive, escalate, ignore.
Related material
Boundaries
Not client monitoring, not production MTTD/MTTR KPIs, not a certified enterprise rollout.
Status
development. Manager, agents and a few scenarios are in progress. I do not publish screenshots from other people’s environments.