Student edition · v22

Chapters

Nine chapters progress from analyst foundations through platform operations. Read them in sequence or open the topic you need.

01Chapter 1Chapter 1 — Introduction to Security Operations CentersBuild the analyst mindset and understand the purpose, people, processes, and technologies of a Security Operations Center.Open →02Chapter 2Chapter 2 — Understanding Security Information and Event Management (SIEM)Understand how SIEM platforms collect, normalize, correlate, and present security telemetry for investigation.Open →03Chapter 3Chapter 3 — Building the Wazuh Security Operations Center LaboratoryBuild and validate the Wazuh-centered Security Operations Center laboratory used throughout the book.Open →04Chapter 4Chapter 4 — Navigating the Wazuh Dashboard and Conducting Security InvestigationsNavigate the Wazuh Dashboard and use evidence-driven workflows to conduct structured security investigations.Open →05Chapter 5Chapter 5 — Detection Engineering with Wazuh and SuricataDesign, test, and tune detections across Wazuh and Suricata while controlling noise and preserving useful evidence.Open →06Chapter 6Chapter 6 — Introduction to Threat HuntingMove from alert-driven response to hypothesis-led threat hunting across endpoint and network telemetry.Open →07Chapter 7Chapter 7 — Introduction to Digital Forensics and Incident ResponseApply digital-forensics and incident-response methods to preserve, examine, and interpret security evidence.Open →08Chapter 8Chapter 8 — Security Operations AutomationUse automation, orchestration, and responsible AI assistance to improve repeatability without surrendering analyst judgment.Open →09Chapter 9Chapter 9 — Operating the PlatformOperate, maintain, troubleshoot, and continuously validate the laboratory platform as a dependable analytical environment.Open →