Skip to content

⌂ Home Chapters Labs Lab Scripts Field guide Appendices

Search the book

Book directory

Quick Access

Search the book

Book Chapters

Front Matter

Attribution, Trademarks & Independence Course Progression & Lab Alignment Download Student Course Kit v22 Table of Contents List of Figures

Chapter 1: Introduction to Security Operations Centers

Chapter Overview 1.1 What Is a Security Operations Center?1.2 Why Organizations Need a SOC 1.3 The Evolution of Cyber Defense 1.4 Events, Alerts, and Incidents 1.5 Security Telemetry — The Lifeblood of the Security Operations Center 1.6 Security Operations Center Organization and Analyst Roles 1.7 A Day in the Life of a SOC Analyst 1.8 Building Your First Security Operations Center Laboratory 1.9 Chapter Summary Lab 0 — Operational Health Validation (Overview)

Chapter 2: Understanding Security Information and Event Management (SIEM)

Chapter Overview 2.1 What Is a SIEM?2.2 The SIEM Data Pipeline 2.3 Event Normalization and Data Enrichment 2.4 Correlation — Turning Data into Intelligence 2.5 Detection Rules — How a SIEM Recognizes Suspicious Activity 2.6 Searching, Investigating, and Thinking Like a SOC Analyst 2.7 Wazuh — An Enterprise SIEM Platform 2.8 Operating a SIEM — From Monitoring to Investigation 2.9 The Wazuh Dashboard — Your Window into the Security Operations Center 2.10 Conducting a SIEM Investigation Using Wazuh 2.11 Building an Investigation Mindset 2.12 SIEM Maturity — From Log Collection to Threat Hunting Case Study 2-1 — Following the Evidence (Chapter 2 Capstone)2.13 Chapter Summary

Chapter 3: Building the Wazuh Security Operations Center Laboratory

Chapter Overview 3.1 Laboratory Planning and Design 3.2 Virtualization — The Foundation of the Modern Security Operations Center 3.3 VMware Virtual Networking 3.4 Understanding the Wazuh Server 3.5 The Wazuh Dashboard as an Operational Console 3.6 Preparing the Ubuntu 26.04 Network Sensor 3.7 Installing and Validating the Wazuh Agent on Ubuntu 26.04 3.8 Understanding Suricata — The Network Detection Engine 3.9 Installing Suricata on Ubuntu 26.04 3.10 Emerging Threats Open — The Intelligence Behind Suricata 3.11 Integrating Suricata with Wazuh 3.12 End-to-End SOC Validation 3.13 Chapter Summary

Chapter 4: Navigating the Wazuh Dashboard and Conducting Security Investigations

Chapter Overview 4.1 Mastering Discover — The Analyst’s Primary Investigation Tool 4.2 Timeline Analysis — Reconstructing Security Events 4.3 Event Correlation — Combining Evidence into Intelligence 4.4 Hypothesis-Driven Investigations 4.5 Professional Incident Documentation Chapter Exercise 4.1 — Writing Your First Incident Report 4.6 Evidence Collection and Preservation 4.7 Indicators of Compromise (IOCs) and Indicators of Attack (IOAs)4.8 Applying the MITRE ATT&CK® Framework to Investigations 4.9 Measuring Detection Coverage with MITRE ATT&CK Navigator

Chapter 5: Detection Engineering with Wazuh and Suricata

Chapter Overview 5.1 Understanding the Wazuh Rule Engine 5.2 Rule Hierarchy, Inheritance, and Evaluation Order 5.3 Creating Your First Custom Wazuh Rule 5.4 Rule Testing, Validation, and Debugging 5.5 Reducing False Positives Through Detection Tuning 5.6 Advanced Detection Tuning and Rule Optimization 5.7 Developing Local Suricata Rules 5.8 Multi-Source Correlation Rules 5.9 Measuring Detection Effectiveness 5.10 Detection Engineering Capstone Project 5.11 Chapter Summary

Chapter 6: Introduction to Threat Hunting

Chapter Overview 6.1 Threat Hunting Fundamentals Chapter Exercise 6.1 — Your First Threat Hunt 6.2 Developing Effective Threat Hunting Hypotheses Chapter Exercise 6.2 — Developing Hunting Hypotheses 6.3 Advanced Threat Hunting with Wazuh Discover Chapter Exercise 6.3 — Advanced Threat Hunting 6.4 Endpoint Threat Hunting with Sysmon Chapter Exercise 6.4 — Endpoint Threat Hunt 6.5 Network Threat Hunting with Suricata and Packet Analysis Chapter Exercise 6.5 — Network Threat Hunt 6.6 Threat Hunting with the MITRE ATT&CK Framework Chapter Exercise 6.6 — ATT&CK-Based Threat Hunt 6.7 Threat Hunting Playbooks and Repeatable Methodologies Chapter Exercise 6.7 — Building a Threat Hunting Playbook 6.8 Adversary Emulation with Atomic Red Team and Caldera Chapter Exercise 6.8 — Validating Detections with Atomic Red Team 6.9 Threat Hunting and Adversary Emulation Capstone 6.10 Chapter Summary

Chapter 7: Introduction to Digital Forensics and Incident Response

Chapter Overview 7.1 Introduction to Digital Forensics and Incident Response Chapter Exercise 7.1 — Responding to Your First Security Incident 7.2 Evidence Collection and Preservation Chapter Exercise 7.2 — Evidence Collection 7.3 Windows Forensic Artifacts Chapter Exercise 7.3 — Windows Artifact Investigation 7.4 Memory Forensics and Live Response Chapter Exercise 7.4 — Live Response Investigation 7.5 Network Forensics and Packet Analysis Chapter Exercise 7.5 — Network Forensics Investigation 7.6 Timeline Analysis and Incident Reconstruction Chapter Exercise 7.6 — Incident Reconstruction 7.7 Incident Reporting and Executive Communication Chapter Exercise 7.7 — Professional Incident Report 7.8 Digital Forensics and Incident Response Capstone 7.9 Chapter Summary

Chapter 8: Security Operations Automation

Chapter Overview 8.1 Security Operations Automation 8.2 Security Orchestration, Automation, and Response (SOAR)8.3 Artificial Intelligence in Security Operations Centers 8.4 AI-Assisted Detection Engineering and Threat Hunting 8.5 Enterprise Security Operations: Architecture, Evolution, and the Future 8.6 Chapter Summary

Chapter 9: Operating the Platform

Chapter Overview 9.1 The Indexer, Retention, and Capacity 9.2 Security Configuration Assessment 9.3 Vulnerability Detection 9.4 The Wazuh API 9.5 Agent Groups and Centralized Configuration 9.6 Onboarding a New Log Source 9.7 Sensor Health and Capture Integrity 9.8 Detection as Code 9.9 The Operational Cadence 9.10 Chapter Summary Knowledge Check Discussion Questions

Progressive Labs

Course Progression & Lab Alignment Lab Topology PL-00 PL-00A PL-01 PL-02 PL-03 PL-04 PL-05 PL-06 PL-07 PL-08 PL-09

Supplemental Labs

SL-01 — Create and verify a forensic artifact container SL-02 — Windows Robocopy transfer and verification SL-03 — Linux rsync transfer and verification SL-04 — Packet parsing and timestamp validation

Lab Scripts

01Wazuh Lab Platform Operations Quick Reference 02Wazuh Dashboard Authorization-Token Troubleshooting 03Wazuh Dashboard Session Timeout Configuration 04Install, Validate, and Integrate Osquery on Ubuntu 26.04 05Osquery Windows Process-to-Network Correlation 06Safe Lab Telemetry Cleanup 07Initial SOC Triage: First 15 Minutes 08Cyber Incident Executive Summary 09Forensic Container Approach

Analyst Desk

How Do We Get It Right?

Analyst Tools Reference

Overview AD.1 WAZUH-SRV AD.2 UB2604 AD.3 WIN11 AD.4 SO14 AD.5 Cross-Platform Tools AD.6 Wazuh Data-Source Map AD.7 Vendor Documentation

Knowledge Checks

KC-1 KC-2 KC-3 KC-4 KC-5 KC-6 KC-7 KC-8 KC-9

Appendix A — Lab Architecture Appendix B — Command Reference Appendix C — ORV Validation Appendix D — ORV Troubleshooting Appendix E — Lab Reset Appendix F — Version Control

Reference & Glossary

Glossary References

Analyst Desk

Knowledge Checks

Questions and complete answer rationales organized by chapter.

KC-1 — Chapter 1 Knowledge Check
KC-2 — Chapter 2 Knowledge Check
KC-3 — Chapter 3 Knowledge Check
KC-4 — Chapter 4 Knowledge Check
KC-5 — Chapter 5 Knowledge Check
KC-6 — Chapter 6 Knowledge Check
KC-7 — Chapter 7 Knowledge Check
KC-8 — Chapter 8 Knowledge Check
KC-9 — Chapter 9 Knowledge Check

Alerts to Answers

Blog Archives

Security Resources

Emerging Threats Open Ruleset ↗ MITRE ATT&CK ↗ NIST Special Publications ↗ Suricata documentation ↗ Wazuh documentation ↗

RTFM

Auditd (Linux Audit) ↗ CyberChef ↗ UTC-GMT-Zulu Time ↗ jq ↗ NetworkMiner ↗ Nmap ↗ Nushell ↗ OpenSSH ↗ osquery ↗ Python 3.13 + pip ↗ Structured Analytical Techniques (SAT) ↗ Suricata 8.x ↗ Sysinternals — Sysmon ↗ tcpdump ↗ tshark ↗ Volatility 3 ↗ Windows Event Logs ↗ Wireshark ↗ YARA ↗ Zimmerman Tools ↗

Alerts to Answers™

Good Findings Fast with Wazuh, Suricata and MoreCore Book · Version 22

TRAINING THE NEXT GENERATION
OF CYBER WARRIORS!

© 2026 Jim Furstenberg - Ph.D., P.I. and Kalos Cybersecurity LLC. All rights reserved.

Alerts to Answers™ and Kalos Cybersecurity™ are trademarks of their respective owner. All third-party product names, logos, and brands are property of their respective owners.

This independent educational publication is not sponsored, endorsed, or affiliated with Wazuh, Suricata, MITRE, or their respective organizations.

Copyright, trademarks & notices