Wazuh + Sysmon Detection Lab
Windows 11 Sysmon telemetry integration with Wazuh, custom detection rules, alert triage workflow and log correlation.
Brute-Force Detection Lab
Windows Security log analysis and brute-force detection using Wazuh SIEM.
Correlation of multiple failed login attempts into high-severity alerts
and investigation using JSON event data.
Network Monitoring Lab
Pi-hole DNS analysis, Suricata IDS, traffic inspection and alert tuning.
Suricata IDS + PCAP Triage
Custom Suricata rules, EVE JSON analysis, suspicious traffic investigation and packet-level triage using Wireshark.
Phishing Analysis Sandbox
Isolated VM detonation, URL and JavaScript inspection, IOC extraction, network traffic monitoring and structured incident reporting.
Docker Security Lab
Nginx log monitoring, Fail2Ban brute-force simulation and incident detection.