HACKING PROJECT · network · Intermediate
SIEM Log-Analysis Home Lab
Build a centralized log-analysis and detection platform that correlates multi-source telemetry into actionable alerts.
Security data is scattered across firewalls, endpoints, servers, and applications, making it nearly impossible to detect multi-stage attacks without centralized correlation. Students rarely get hands-on time building the ingestion, parsing, and detection-rule pipeline that underpins every SOC. Without a SIEM, alerts lack context and analysts cannot reconstruct an attack timeline.
**What you'll build**
Deploy a full SIEM stack (Elastic Stack or Wazuh, alternatively Splunk Free) that ingests logs from Windows (Sysmon), Linux, network devices, and the other lab sensors. Normalize and parse events, build correlation rules and dashboards, and author detections mapped to ATT&CK. Generate attacks with an adversary-emulation tool (Atomic Red Team/Caldera) to validate detections end to end.
**Objective** — Build a centralized log-analysis and detection platform that correlates multi-source telemetry into actionable alerts.
**Expected outcome** — A working SIEM with parsed data sources, a library of ATT&CK-mapped detection rules and dashboards, and a validation report from emulated attacks.
**Difficulty** — Intermediate — stack deployment is guided, but log parsing, correlation logic, and detection tuning require real analytical depth.
**Primary category** — SOC / SIEM; Secondary = Detection Engineering, Threat Hunting, DFIR
**Security domains** — Primary = Blue Team; Secondary = Incident Response, Threat Hunting, Purple Team, SOC Operations
**Technical focus** — Log ingestion/parsing, event normalization, correlation rules, detection engineering, dashboarding, alert triage, Sysmon telemetry, adversary emulation, log retention/pipeline design
**Core technologies** — Languages: Python, SPL/KQL/Lucene, Bash, PowerShell, regex; Frameworks/Libraries: Elastic Stack, Wazuh, Sigma, Atomic Red Team; Security Tools: Sysmon, Winlogbeat/Filebeat, Splunk Free, Caldera; Cloud/Infra: Linux/Windows VMs, Docker, syslog; AI/Data: Kibana/OpenSearch Dashboards, ML anomaly jobs; Databases: Elasticsearch/OpenSearch, index lifecycle management
**Where it's valued** — Every enterprise SOC, MSSP, finance, healthcare, government, tech
**Careers it builds toward** — SOC Analyst (Tier 1–3), SIEM Engineer, Detection Engineer, Threat Hunter, Incident Responder, Security Analyst
**Framework alignment**
• MITRE ATT&CK: Broad detection coverage — Command and Scripting Interpreter (T1059), Valid Accounts (T1078), Account Manipulation (T1098), Scheduled Task/Job (T1053), Credential Dumping (T1003), Lateral Movement/Remote Services (T1021); rules authored in Sigma and mapped to techniques
• NIST CSF 2.0: Detect (DE.CM, DE.AE), Respond (RS.AN, RS.MI), Govern (GV.OC via logging policy), Identify (ID.RA)
• OWASP: Ingests app/API logs to detect OWASP Top 10 exploitation (Injection, Broken Access Control, SSRF); otherwise N/A
• CIS Controls v8: 8 (Audit Log Management — core), 13 (Network Monitoring and Defense), 6 (Access Control Management), 17 (Incident Response Management)
**Innovation** — Improved Existing Solution — SIEM labs are common, but a well-parsed, ATT&CK-mapped, validated detection library is a high-value, directly employable artifact. Scores: Innovation 5/10, Startup 4/10, Enterprise-Readiness 9/10, Patent = No.