Student edition · v19
Hands-on labs
Student-only laboratory exercises. Instructor guides and answer keys are excluded.
Lab 0 — Wazuh & Suricata: Initial Lab Testing and Validation
Alerts to Answers Lab 0 — Wazuh & Suricata: Initial Lab Testing and Validation Introduction Objective Validate that every component of your Enterprise Security Operations Center…
Read →Student labLab 1 — SIEM Familiarization & Your First Detection
Alerts to Answers Lab 1 — SIEM Familiarization & Your First Detection This is the most heavily guided lab in the book. Every command is explained line by line, every step tells…
Read →Student labLab 2 — SIEM Configuration & Attack Analysis
Alerts to Answers Lab 2 — SIEM Configuration & Attack Analysis Lab 1 taught you to find an attack. This lab teaches you to investigate one. It is designed not to teach you where…
Read →Student labLab 3 — SIEM Analyst Use-Case Walkthrough
Alerts to Answers Lab 3 — SIEM Analyst Use-Case Walkthrough This lab walks the complete threat lifecycle end to end on a scenario you generate yourself: collect → detect → qualify…
Read →Student labLab 4 — SIEM Ransomware Investigation
Alerts to Answers Lab 4 — SIEM Ransomware Investigation Ransomware is fast, loud, and unforgiving — which makes it a perfect teacher. In this lab you configure File Integrity…
Read →Student labLab 5 — Sysmon Investigation: Reconstructing an Attack from Endpoint Telemetry
Alerts to Answers Lab 5 — Sysmon Investigation: Reconstructing an Attack from Endpoint Telemetry Introduction Objective Reconstruct a complete attack chain on WIN11 using only…
Read →Student labLab 6 — Emerging Threats Investigation: Hunting an Attack Across the Network
Alerts to Answers Lab 6 — Emerging Threats Investigation: Hunting an Attack Across the Network Introduction Objective Reconstruct a multi-stage network attack using Suricata and…
Read →Student labLab 7 — Threat Intelligence Investigation: Enriching Indicators and Operationalizing Intel
Alerts to Answers Lab 7 — Threat Intelligence Investigation: Enriching Indicators and Operationalizing Intel Introduction Objective Take a set of raw indicators pulled from your…
Read →Student labLab 8 — Capstone: File Integrity Monitoring, Active Response, and Correlated Investigation
Alerts to Answers Lab 8 — Capstone: File Integrity Monitoring, Active Response, and Correlated Investigation Introduction Objective Complete the analyst arc from detection to…
Read →Student labLab 9 — Diagnostic Challenge
Lab 9 — Diagnostic Challenge Estimated time: 90 minutes Machines used: WAZUH-SRV, UB2604, WIN11 Prerequisites: Labs 0 through 8 complete; environment previously validated Purpose…
Read →