Appendix C — SOC Operational Readiness Validation (ORV) Procedure and Checklist

Purpose

Before beginning any laboratory exercise, verify that all components of the Enterprise Security Operations Center (SOC) are operational and communicating correctly.

This validation confirms:

• Virtual machines are running.

• Wazuh services are healthy.

• Wazuh agents are connected.

• Windows endpoint telemetry is being collected.

• Network IDS alerts are functioning.

• Malware detection is operational.

If any validation fails, correct the issue before beginning the lab. For diagnostic steps and corrective actions, use Appendix D — ORV Troubleshooting and Recovery Guide.

Estimated Time: 15–20 minutes

Step 1 — Start the Lab Environment

Start the following virtual machines.

Wait approximately 2–3 minutes for all systems to finish booting.

Step 2 — Verify the Wazuh Server

Log into the Wazuh Server.

Run:

::: {custom-style="CodeLabel"} WIN11 · Terminal :::

sudo /var/ossec/bin/wazuh-control status

Expected Result

All services should report running.

If not:

::: {custom-style="CodeLabel"} WIN11 · Terminal :::

sudo /var/ossec/bin/wazuh-control restart

Step 3 — Verify Dashboard Access

Open a web browser.

Go to:

https://192.168.1.30

Login

Username admin

Password

Wazuh does not use a static default password. A strong, random password was generated for the admin account during installation and printed to the console at the end of the wazuh-install.sh run. If you did not record it at the time, retrieve it from the archive the installer created:

::: {custom-style="CodeLabel"} Wazuh Dashboard · Discover query :::

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Look for the line beginning ‘admin’ and use that password to log in.

Verify the Dashboard loads successfully.

Best Practice

Never document or teach “admin/admin” as a working credential for Wazuh — it is not the default, and normalizing guessable credentials, even in a lab, builds the wrong habit for production environments.

Step 4 — Verify Agent Connectivity

Navigate to

Wazuh → Agents

Verify both agents are connected.

If an agent is disconnected:

Restart the agent.

Windows

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Restart-Service WazuhSvc

Ubuntu

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

sudo systemctl restart wazuh-agent

Refresh the Dashboard.

Step 5 — Validate Sysmon

On Windows 11, open PowerShell.

Run:

notepad

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Resolve-DnsName www.microsoft.com

::: {custom-style="CodeLabel"} WIN11 · PowerShell :::

Invoke-WebRequest https://www.microsoft.com

Close Notepad.

Validate Locally

Open

Event Viewer

Navigate to

Applications and Services Logs

Microsoft

Windows

Sysmon

Operational

Verify Event IDs

• 1

• 3

• 22

If they are missing:

• Verify Sysmon service

• Verify configuration

• Repeat the commands

Validate in Wazuh

Open the Dashboard.

Filter

Agent = win11

Verify Event IDs

• 1

• 3

• 22

Step 6 — Validate Suricata

From the Ubuntu sensor (or any system with nmap on the lab network)

::: {custom-style="CodeLabel"} WIN11 · Terminal :::

nmap -sS 192.168.1.40

Open the Dashboard.

Filter

Agent = u2604

Verify an Emerging Threats (ET Open) alert appears.

If no alert appears:

Check

::: {custom-style="CodeLabel"} WIN11 · Terminal :::

sudo systemctl status suricata

Verify

::: {custom-style="CodeLabel"} WIN11 · Terminal :::

sudo tail /var/log/suricata/eve.json

Step 7 — Validate Microsoft Defender

Browse to

https://secure.eicar.org/eicar.com.txt

Download eicar.com

Expected

Microsoft Defender immediately quarantines the file.

Open

Windows Security

Virus & threat protection

Protection history

Verify the detection.

Validate in Wazuh

Search for the Defender alert.

Verify it references

• win11

• Microsoft Defender

• EICAR detection

ORV Completion Checklist

Lab Complete

Your Enterprise Security Operations Center has been successfully validated.

You have confirmed:

• Wazuh infrastructure is operational.

• Windows endpoint telemetry is functioning.

• Network intrusion detection is operational.

• Malware detection is operational.

• All security events are successfully reaching the Wazuh Dashboard.

You are now ready to begin the next laboratory exercise.

    Version 5       Page  of

Alerts to Answers