Kalos Cybersecurity LLC

Book appendix · v22

Appendix C — SOC Operational Readiness Validation Procedure and Checklist

Validate the SOC laboratory before beginning an investigation.

Appendix

Purpose

Before beginning any laboratory exercise, verify that all components of the Enterprise Security Operations Center (SOC) are operational and communicating correctly.

This validation confirms:

  • Virtual machines are running.
  • Wazuh services are healthy.
  • Wazuh agents are connected.
  • Windows endpoint telemetry is being collected.
  • Network IDS alerts are functioning.
  • Malware detection is operational.

If any validation fails, correct the issue before beginning the lab.

For diagnostic steps and corrective actions, use Appendix D — ORV Troubleshooting and Recovery Guide.

Estimated Time: 15–20 minutes

Step 1 — Start the Lab Environment

Start the following virtual machines.

Virtual Machine Purpose
Wazuh Server SIEM
Windows 11 (win11) Endpoint
Ubuntu 26.04 (UB2604) Suricata Sensor; Wazuh agent u2604
Security Onion 14.04.5.2 Network Monitoring

Wait approximately 2–3 minutes for all systems to finish booting.

Step 2 — Verify the Wazuh Server

Log into the Wazuh Server.

Run:

WIN11 · Terminal

sudo /var/ossec/bin/wazuh-control status

Expected Result

All services should report running.

If not:

WIN11 · Terminal

sudo /var/ossec/bin/wazuh-control restart

Step 3 — Verify Dashboard Access

  1. Open a web browser and go to https://192.168.1.30.
  2. Sign in with the username admin and the generated administrator password.

Password guidance

Wazuh does not use a static default password. A strong, random password was generated for the admin account during installation and printed to the console at the end of the wazuh-install.sh run. If you did not record it at the time, retrieve it from the archive the installer created:

Wazuh Dashboard · Discover query

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Look for the line beginning ‘admin’ and use that password to log in.

Verify the Dashboard loads successfully.

Best Practice

Never document or teach “admin/admin” as a working credential for Wazuh — it is not the default, and normalizing guessable credentials, even in a lab, builds the wrong habit for production environments.

Step 4 — Verify Agent Connectivity

Navigate to

Wazuh → Agents

Verify both agents are connected.

Agent Status
win11 Active
u2604 Active

If an agent is disconnected:

Restart the agent.

Windows

WIN11 · PowerShell

Restart-Service WazuhSvc

Ubuntu

WIN11 · PowerShell

sudo systemctl restart wazuh-agent

Refresh the Dashboard.

Step 5 — Validate Sysmon

On Windows 11, open PowerShell.

Run:

notepad

WIN11 · PowerShell

Resolve-DnsName www.microsoft.com

WIN11 · PowerShell

Invoke-WebRequest https://www.microsoft.com

Close Notepad.

Validate Locally

Open Event Viewer, and then navigate to Applications and Services Logs → Microsoft → Windows → Sysmon → Operational.

Verify these Event IDs:

  • 1
  • 3
  • 22

If they are missing:

  • Verify Sysmon service
  • Verify configuration
  • Repeat the commands

Validate in Wazuh

Open the Dashboard, filter for Agent = win11, and verify these Event IDs:

  • 1
  • 3
  • 22

Step 6 — Validate Suricata

From the Ubuntu sensor (or any system with nmap on the lab network)

WIN11 · Terminal

nmap -sS 192.168.1.40

Open the Dashboard, filter for Agent = u2604, and verify that an Emerging Threats (ET Open) alert appears.

If no alert appears:

Check

WIN11 · Terminal

sudo systemctl status suricata

Verify

WIN11 · Terminal

sudo tail /var/log/suricata/eve.json

Step 7 — Validate Microsoft Defender

Browse to

https://secure.eicar.org/eicar.com.txt

Download eicar.com

For the complete controlled procedure—including YARA matching, Microsoft Defender telemetry review, and Wazuh verification—use Lab 0A — EICAR, YARA, Microsoft Defender, and Wazuh Validation.

Expected

Microsoft Defender immediately quarantines the file.

Open

Windows Security

Virus & threat protection

Protection history

Verify the detection.

Validate in Wazuh

Search for the Defender alert.

Verify it references

  • win11
  • Microsoft Defender
  • EICAR detection

ORV Completion Checklist

Item Pass
All VMs running ☐
Wazuh services running ☐
Dashboard accessible ☐
win11 connected ☐
u2604 connected ☐
Sysmon Event ID 1 ☐
Sysmon Event ID 3 ☐
Sysmon Event ID 22 ☐
Suricata ET alert ☐
Microsoft Defender alert ☐
EICAR alert in Wazuh ☐

Lab Complete

Your Enterprise Security Operations Center has been successfully validated.

You have confirmed:

  • Wazuh infrastructure is operational.
  • Windows endpoint telemetry is functioning.
  • Network intrusion detection is operational.
  • Malware detection is operational.
  • All security events are successfully reaching the Wazuh Dashboard.

You are now ready to begin the next laboratory exercise.