Overview
Real-time Security Information & Event Management (SIEM) system for enterprise threat detection and compliance validation. Centralized log aggregation from 100+ sources, automated alert correlation, MITRE ATT&CK threat mapping, and multi-framework compliance reporting.
Environment & Scope
Lab Setup
Wazuh Manager (4.5+) | Elasticsearch 8.0+ | Kibana 8.0+ | Ubuntu 20.04 LTS | 4GB RAM minimum | Docker Compose deployment
Scope
- • Log aggregation from 100+ endpoints and devices • Real-time alert correlation and anomaly detection • MITRE ATT&CK technique mapping • Compliance scoring for GDPR, HIPAA, PCI-DSS, ISO27001 • Automated response trigger execution • Multi-tenant dashboard organization
Methodology
- 1. Wazuh Manager deployment and hardening 2. Agent installation on Linux, Windows, network devices 3. Log source configuration (syslog, AWS CloudTrail, Windows Event Log) 4. Custom detection rule creation 5. Alert correlation and threshold tuning 6. Compliance rule mapping and evidence collection 7. Response automation with webhooks/playbooks
Key Findings
• Compliance mapping for GDPR, HIPAA, PCI-DSS • Real-time visibility into SOC operations
Business Impact
An attacker could exfiltrate data undetected. Defenders would miss lateral movement and multi-stage attacks. This SIEM catches stage 1 reconnaissance through stage 5 actions on objectives with full audit trail.
Remediation & Improvements
- • Alert tuning: feedback loop to reduce false positives • Playbook automation: reduce manual triage • Integration: Slack, PagerDuty, Jira for incident workflow • Training: SOC analyst onboarding and certification
Lessons Learned
- 1. Alert fatigue kills detection — tuning is a large part of SOC success 2. Centralized logging reveals patterns no single system can detect 3. MITRE ATT&CK framework bridges threat intel and detection
Technologies
Tools & Platforms: Wazuh | Elasticsearch | Kibana | Python | Bash
Hiring Relevance: Safaricom SOC Analyst, Equity Bank Security Operations, Enterprise SIEM expertise
View on GitHub
Full implementation, README, and deployment instructions available at:
GitHub Repository →