| Figure 1-1. Core Functions of a Security Operations Center |
22 |
| Figure 1-2. Evolution of Enterprise Cyber Defense |
27 |
| Figure 1-3. Events Become Alerts |
30 |
| Figure 1-4. Event → Alert → Incident |
33 |
| Figure 1-5. Telemetry Is Observation |
38 |
| Figure 1-6. From Data to Intelligence |
41 |
| Figure 1-7. Security Monitoring Pipeline |
43 |
| Figure 1-8. The Three Pillars of a Security Operations Center |
45 |
| Figure 1-9. Typical SOC Structure |
46 |
| Figure 1-10. The Analyst Workflow |
49 |
| Figure 1-11. Daily SOC Startup Checklist |
51 |
| Figure 1-12. Multi-Sensor Investigation |
56 |
| Figure 1-13. Laboratory Architecture |
60 |
| Figure 1-14. Endpoint Telemetry Pipeline |
64 |
| Figure 1-15. Network Detection Pipeline |
64 |
| Figure 1-16. Laboratory Method |
73 |
| Figure 2-1. Evolution of SIEM |
77 |
| Figure 2-2. Security Before SIEM |
79 |
| Figure 2-3. Security After SIEM |
79 |
| Figure 2-4. Event Generation |
83 |
| Figure 2-5. Multiple Sensors Observe One System |
84 |
| Figure 2-6. Secure Telemetry Transport |
85 |
| Figure 2-7. Decoding |
86 |
| Figure 2-8. Complete Wazuh Processing Pipeline |
88 |
| Figure 2-9. Did Nmap Generate Traffic? — Decision Flow |
89 |
| Figure 2-10. Before Normalization |
90 |
| Figure 2-11. After Normalization |
91 |
| Figure 2-12. Data Enrichment |
94 |
| Figure 2-13. Correlation Timeline |
97 |
| Figure 2-14. Correlation Dimensions |
101 |
| Figure 2-15. Security Event — Decision Flow |
104 |
| Figure 2-16. Rule Logic |
105 |
| Figure 2-17. Rule Tuning |
109 |
| Figure 2-18. The Investigation Mindset |
113 |
| Figure 2-19. From Hostname to Specific Process |
113 |
| Figure 2-20. Investigation Timeline — Authentication Events |
114 |
| Figure 2-21. Investigation Timeline — Ordering Events by Time |
115 |
| Figure 2-22. Timeline Investigation |
117 |
| Figure 2-23. Alert — Decision Flow |
119 |
| Figure 2-24. Wazuh Architecture |
121 |
| Figure 2-25. Responsibilities of Each Component |
124 |
| Figure 2-26. Wazuh as the Central Hub |
126 |
| Figure 2-27. From Begin Shift to Continuous Improvement |
128 |
| Figure 2-28. Operational Monitoring vs. Security Monitoring |
130 |
| Figure 2-29. From Alert to Conclusion |
131 |
| Figure 2-30. Dashboard vs. Investigation |
133 |
| Figure 2-31. Continuous Improvement Cycle |
135 |
| Figure 2-32. Dashboard Responsibilities |
137 |
| Figure 2-33. Alert Investigation Workflow |
140 |
| Figure 2-34. Investigation Methodology |
144 |
| Figure 2-35. Evidence Correlation |
147 |
| Figure 2-36. Questions Drive Investigations |
152 |
| Figure 2-37. Corroborating Evidence |
155 |
| Figure 2-38. From Entire Environment to Specific Event |
157 |
| Figure 2-39. SIEM Maturity Level 1 |
161 |
| Figure 2-40. Correlation |
163 |
| Figure 2-41. Continuous Improvement |
164 |
| Figure 2-42. From User Login to Alert |
172 |
| Figure 3-1. Complete Laboratory Topology |
187 |
| Figure 3-2. Secure Agent Communication |
187 |
| Figure 3-3. From Network Packet to SOC Analyst |
189 |
| Figure 3-4. Laboratory Address Plan |
196 |
| Figure 3-5. Physical vs. Virtual Infrastructure |
199 |
| Figure 3-6. Snapshot Workflow |
203 |
| Figure 3-7. VMware Virtual Switch |
206 |
| Figure 3-8. VMware Networking Modes |
207 |
| Figure 3-9. Dual-Homed Ubuntu Sensor |
208 |
| Figure 3-10. From Windows Browser to Dashboard |
209 |
| Figure 3-11. Packet Visibility |
210 |
| Figure 3-12. Wazuh Service Architecture |
213 |
| Figure 3-13. Simplified Directory Tree |
216 |
| Figure 3-14. The Dashboard as the SOC Instrument Panel |
221 |
| Figure 3-15. Daily SOC Startup Workflow |
225 |
| Figure 3-16. Ubuntu Sensor Responsibilities |
227 |
| Figure 3-17. Ubuntu Agent Communication |
235 |
| Figure 3-18. From Install to Document |
236 |
| Figure 3-19. Telemetry Validation |
239 |
| Figure 3-20. Endpoint vs. Network Visibility |
244 |
| Figure 3-21. Suricata Processing Pipeline |
245 |
| Figure 3-22. From Client to HTTP Response |
247 |
| Figure 3-23. Suricata to Wazuh |
249 |
| Figure 3-24. Software Deployment Lifecycle |
251 |
| Figure 3-25. Suricata Directory Tree |
253 |
| Figure 3-26. Initial Validation |
257 |
| Figure 3-27. Detection Pipeline |
260 |
| Figure 3-28. Rule Management |
264 |
| Figure 3-29. Complete Network Detection Pipeline |
268 |
| Figure 3-30. Validation Stage 1 |
273 |
| Figure 3-31. Validation Stage 2 |
274 |
| Figure 3-32. Operational Validation |
277 |
| Figure 3-33. Multi-Source Correlation |
281 |
| Figure 4-1. The Investigation Lifecycle |
291 |
| Figure 4-2. Investigation Funnel |
295 |
| Figure 4-3. From PowerShell to Suricata HTTP Detection |
297 |
| Figure 4-4. The Discover Workflow |
300 |
| Figure 4-5. Discover Layout |
301 |
| Figure 4-6. Progressive Filtering |
302 |
| Figure 4-7. From Phishing Email to Data Exfiltration |
309 |
| Figure 4-8. Timeline Thinking |
310 |
| Figure 4-9. From PowerShell to Defender Detection |
311 |
| Figure 4-10. From Defender Detection to Update Service |
311 |
| Figure 4-11. Timeline Expansion |
314 |
| Figure 4-12. Attack Timeline |
319 |
| Figure 4-13. Investigation Timeline — Endpoint Compromise |
320 |
| Figure 4-14. Individual Visibility |
322 |
| Figure 4-15. From PowerShell to Suricata Alert |
324 |
| Figure 4-16. From Student01 to Remote Login |
325 |
| Figure 4-17. From Download to Defender Detection |
325 |
| Figure 4-18. Confidence Pyramid |
326 |
| Figure 4-19. Investigation Process |
329 |
| Figure 4-20. Hypothesis Testing |
336 |
| Figure 4-21. From Observations to Conclusion |
346 |
| Figure 4-22. Evidence Sources |
355 |
| Figure 4-23. From Original File to Integrity Verified |
359 |
| Figure 4-24. IOC vs. IOA |
369 |
| Figure 4-25. From WINWORD.EXE to Beaconing |
370 |
| Figure 4-26. From PowerShell to Persistence |
372 |
| Figure 4-27. ATT&CK Philosophy |
377 |
| Figure 4-28. Mapping Events to ATT&CK |
379 |
| Figure 4-29. Detection Coverage Concept |
385 |
| Figure 4-30. Example Coverage Matrix |
387 |
| Figure 4-31. From Identify Gap to Repeat |
390 |
| Figure 5-1. Detection Engineering Lifecycle |
397 |
| Figure 5-2. From WINWORD.EXE to Executable Download |
399 |
| Figure 5-3. Detection Quality |
400 |
| Figure 5-4. From Define Behavior to Deploy |
401 |
| Figure 5-5. Wazuh Event Processing Pipeline |
403 |
| Figure 5-6. Decoder Function |
405 |
| Figure 5-7. Decoder and Rule Relationship |
407 |
| Figure 5-8. From Sysmon Event to PowerShell Download Rule |
407 |
| Figure 5-9. Rule Hierarchy |
411 |
| Figure 5-10. From Parent to Encoded PowerShell |
413 |
| Figure 5-11. From Event Received to Download Rule |
414 |
| Figure 5-12. Progressive Evaluation |
415 |
| Figure 5-13. Rule Organization |
416 |
| Figure 5-14. Detection Engineering |
420 |
| Figure 5-15. From Observe Behavior to Document |
420 |
| Figure 5-16. Rule Anatomy |
423 |
| Figure 5-17. Validation Workflow |
424 |
| Figure 5-18. Detection Validation Lifecycle |
428 |
| Figure 5-19. Positive vs Negative Testing |
431 |
| Figure 5-20. Debugging Flowchart |
433 |
| Figure 5-21. Detection Outcomes |
434 |
| Figure 5-22. False Positive |
439 |
| Figure 5-23. Detection Balance |
439 |
| Figure 5-24. From WINWORD.EXE to Outbound HTTP |
441 |
| Figure 5-25. Context Improves Detection |
441 |
| Figure 5-26. Frequency Detection |
443 |
| Figure 5-27. Continuous Detection Improvement |
447 |
| Figure 5-28. Precision and Recall |
450 |
| Figure 5-29. Rule Lifecycle |
452 |
| Figure 5-30. Multi-Layer Detection |
457 |
| Figure 5-31. Packet Processing Pipeline |
459 |
| Figure 5-32. Rule Structure |
460 |
| Figure 5-33. Signature Validation |
462 |
| Figure 5-34. Correlation Improves Confidence |
467 |
| Figure 5-35. From Sysmon to Wazuh Correlation |
468 |
| Figure 5-36. Investigation Timeline — Correlated Sysmon Events |
469 |
| Figure 5-37. From WIN11 to Scheduled Task |
469 |
| Figure 5-38. From WINWORD.EXE to curl.exe |
470 |
| Figure 5-39. Behavioral Chain |
470 |
| Figure 5-40. Detection Engineering Workflow |
472 |
| Figure 5-41. Continuous Measurement |
476 |
| Figure 5-42. SOC Efficiency |
480 |
| Figure 5-43. From Windows 11 to Dashboard |
485 |
| Figure 5-44. From Network to Correlation Rule |
486 |
| Figure 5-45. From PowerShell to Correlated Alert |
487 |
| Figure 6-1. Monitoring vs Threat Hunting |
497 |
| Figure 6-2. Threat Hunting Lifecycle |
499 |
| Figure 6-3. Hunt Development |
501 |
| Figure 6-4. Building a Hypothesis |
508 |
| Figure 6-5. Hunt Prioritization |
511 |
| Figure 6-6. From PowerShell to Defender |
513 |
| Figure 6-7. Hypothesis Validation |
514 |
| Figure 6-8. From PowerShell to Timeline |
517 |
| Figure 6-9. Hunt Refinement |
518 |
| Figure 6-10. DNS Hunt — Endpoint Event Chain (Wazuh Discover) |
522 |
| Figure 6-11. From PowerShell to Timeline |
524 |
| Figure 6-12. Investigative Pivoting |
524 |
| Figure 6-13. From WINWORD.EXE to Windows Defender Detection |
528 |
| Figure 6-14. Sysmon Visibility |
529 |
| Figure 6-15. From Explorer to payload.exe |
530 |
| Figure 6-16. Command-Line Analysis |
531 |
| Figure 6-17. From PowerShell to Download |
532 |
| Figure 6-18. Endpoint Timeline |
533 |
| Figure 6-19. Dual Perspective Investigation |
538 |
| Figure 6-20. DNS Hunt — Network Perspective (Suricata) |
539 |
| Figure 6-21. Network Investigation Pyramid |
541 |
| Figure 6-22. From Every 60 Seconds to Same Packet Size |
542 |
| Figure 6-23. From Word to Incident Confirmed |
544 |
| Figure 6-24. ATT&CK-Driven Hunting |
547 |
| Figure 6-25. ATT&CK Hunting Matrix |
550 |
| Figure 6-26. Threat Hunting Playbook Workflow |
556 |
| Figure 6-27. PowerShell Found? — Decision Flow |
558 |
| Figure 6-28. Hunt Review Cycle |
560 |
| Figure 6-29. Continuous Security Validation |
565 |
| Figure 6-30. From Execution to Validate Detection |
567 |
| Figure 6-31. From Initial Access to Exfiltration |
568 |
| Figure 6-32. Atomic vs Caldera |
570 |
| Figure 6-33. From Execute Atomic Test to Improve Detection |
571 |
| Figure 6-34. Detection Validation Pipeline |
572 |
| Figure 6-35. Telemetry Validation |
579 |
| Figure 7-1. Defensive Operations |
589 |
| Figure 7-2. Sources of Evidence |
591 |
| Figure 7-3. Chain of Custody |
593 |
| Figure 7-4. Incident Response Lifecycle |
593 |
| Figure 7-5. Evidence Lifecycle |
599 |
| Figure 7-6. Evidence Priority |
601 |
| Figure 7-7. Integrity Verification |
602 |
| Figure 7-8. Windows Artifact Ecosystem |
609 |
| Figure 7-9. Registry Persistence |
611 |
| Figure 7-10. From Browser Download to Timeline |
614 |
| Figure 7-11. Volatile Evidence |
618 |
| Figure 7-12. Process Investigation |
621 |
| Figure 7-13. Live Correlation |
623 |
| Figure 7-14. Network Evidence |
628 |
| Figure 7-15. Network Conversation |
630 |
| Figure 7-16. Encrypted Communications |
631 |
| Figure 7-17. Multi-Source Correlation |
632 |
| Figure 7-18. From Scope to Conclusion |
634 |
| Figure 7-19. From Incident Report to Lessons Learned |
635 |
| Figure 7-20. Timeline Reconstruction |
638 |
| Figure 7-21. Event Correlation |
640 |
| Figure 7-22. Layered Timeline |
641 |
| Figure 7-23. Investigation Timeline — Forensic Reconstruction |
643 |
| Figure 7-24. Investigation Lifecycle |
648 |
| Figure 7-25. Root Cause Analysis |
651 |
| Figure 7-26. Continuous Improvement |
654 |
| Figure 7-27. From Detect to Improve |
658 |
| Figure 7-28. From Volatile Evidence to Chain of Custody |
660 |
| Figure 7-29. From Sysmon to Timeline |
661 |
| Figure 7-30. Enterprise Investigation |
661 |
| Figure 7-31. From Containment to Lessons Learned |
663 |
| Figure 8-1. Manual vs Automated Workflow |
672 |
| Figure 8-2. Human Decision Point |
674 |
| Figure 8-3. Automated Enrichment |
676 |
| Figure 8-4. SIEM vs SOAR |
680 |
| Figure 8-5. Enterprise SOAR Architecture |
682 |
| Figure 8-6. From High-Severity Malware Alert to Isolate Endpoint |
683 |
| Figure 8-7. SOAR Playbook |
685 |
| Figure 8-8. AI-Assisted Investigation |
690 |
| Figure 8-9. AI Hunting Workflow |
692 |
| Figure 8-10. Human Validation |
694 |
| Figure 8-11. AI-Assisted Detection Development |
700 |
| Figure 8-12. AI Detection Workflow |
702 |
| Figure 8-13. From Existing Detections to Engineering Priorities |
703 |
| Figure 8-14. Evolution of the SOC |
709 |
| Figure 8-15. XDR |
711 |
| Figure 9-1. Building Versus Operating |
720 |
| Figure 9-2. Index Lifecycle |
721 |
| Figure 9-3. Silent Failure — Disk Exhaustion |
722 |
| Figure 9-4. Retention Decision |
723 |
| Figure 9-5. Security Configuration Assessment |
724 |
| Figure 9-6. Two Different Questions |
725 |
| Figure 9-7. Vulnerability Detection |
725 |
| Figure 9-8. Wazuh API Request Flow |
726 |
| Figure 9-9. What the API Enables |
727 |
| Figure 9-10. Centralized Configuration with Agent Groups |
727 |
| Figure 9-11. Onboarding a New Log Source |
728 |
| Figure 9-12. Where Onboarding Fails |
730 |
| Figure 9-13. Capture Health Check |
731 |
| Figure 9-14. Packet Loss Produces Silent Blindness |
731 |
| Figure 9-15. Detection as Code |
732 |
| Figure 9-16. Operational Cadence |
734 |
| Figure A-1. Enterprise SOC Laboratory Topology |
930 |
| Figure D-1. SOC Troubleshooting Sequence |
1001 |
