Entry	Printed page
Chapter 1 — Introduction to Security Operations Centers	20
1.1 What Is a Security Operations Center?	22
1.2 Why Organizations Need a SOC	23
1.3 The Evolution of Cyber Defense	24
1.4 Events, Alerts, and Incidents	29
1.5 Security Telemetry — The Lifeblood of the Security Operations Center	36
1.6 Security Operations Center Organization and Analyst Roles	44
1.7 A Day in the Life of a SOC Analyst	50
1.8 Building Your First Security Operations Center Laboratory	58
1.9 Chapter Summary	66
Chapter 2 — Understanding Security Information and Event Management (SIEM)	75
2.1 What Is a SIEM?	76
2.2 The SIEM Data Pipeline	82
2.3 Event Normalization and Data Enrichment	89
2.4 Correlation — Turning Data into Intelligence	96
2.5 Detection Rules — How a SIEM Recognizes Suspicious Activity	103
2.6 Searching, Investigating, and Thinking Like a SOC Analyst	112
2.7 Wazuh — An Enterprise SIEM Platform	120
2.8 Operating a SIEM — From Monitoring to Investigation	128
2.9 The Wazuh Dashboard — Your Window into the Security Operations Center	136
2.10 Conducting a SIEM Investigation Using Wazuh	144
2.11 Building an Investigation Mindset	151
2.12 SIEM Maturity — From Log Collection to Threat Hunting	160
2.13 Chapter Summary	174
Chapter 3 — Building the Wazuh Security Operations Center Laboratory	183
3.1 Laboratory Planning and Design	191
3.2 Virtualization — The Foundation of the Modern Security Operations Center	198
3.3 VMware Virtual Networking	205
3.4 Understanding the Wazuh Server	212
3.5 The Wazuh Dashboard as an Operational Console	220
3.6 Preparing the Ubuntu 26.04 Network Sensor	226
3.7 Installing and Validating the Wazuh Agent on Ubuntu 26.04	234
3.8 Understanding Suricata — The Network Detection Engine	243
3.9 Installing Suricata on Ubuntu 26.04	251
3.10 Emerging Threats Open — The Intelligence Behind Suricata	259
3.11 Integrating Suricata with Wazuh	267
3.12 End-to-End SOC Validation	276
3.13 Chapter Summary	285
Chapter 4 — Navigating the Wazuh Dashboard and Conducting Security Investigations	290
4.1 Mastering Discover — The Analyst’s Primary Investigation Tool	299
4.2 Timeline Analysis — Reconstructing Security Events	308
4.3 Event Correlation — Combining Evidence into Intelligence	321
4.4 Hypothesis-Driven Investigations	331
4.5 Professional Incident Documentation	341
4.6 Evidence Collection and Preservation	353
4.7 Indicators of Compromise (IOCs) and Indicators of Attack (IOAs)	366
4.8 Applying the MITRE ATT&CK® Framework to Investigations	376
4.9 Measuring Detection Coverage with MITRE ATT&CK Navigator	384
Chapter 5 — Detection Engineering with Wazuh and Suricata	396
5.1 Understanding the Wazuh Rule Engine	403
5.2 Rule Hierarchy, Inheritance, and Evaluation Order	410
5.3 Creating Your First Custom Wazuh Rule	419
5.4 Rule Testing, Validation, and Debugging	427
5.5 Reducing False Positives Through Detection Tuning	438
5.6 Advanced Detection Tuning and Rule Optimization	446
5.7 Developing Local Suricata Rules	456
5.8 Multi-Source Correlation Rules	466
5.9 Measuring Detection Effectiveness	476
5.10 Detection Engineering Capstone Project	484
5.11 Chapter Summary	491
Chapter 6 — Introduction to Threat Hunting	496
6.1 Threat Hunting Fundamentals	497
6.2 Developing Effective Threat Hunting Hypotheses	507
6.3 Advanced Threat Hunting with Wazuh Discover	517
6.4 Endpoint Threat Hunting with Sysmon	527
6.5 Network Threat Hunting with Suricata and Packet Analysis	537
6.6 Threat Hunting with the MITRE ATT&CK Framework	546
6.7 Threat Hunting Playbooks and Repeatable Methodologies	555
6.8 Adversary Emulation with Atomic Red Team and Caldera	564
6.9 Threat Hunting and Adversary Emulation Capstone	576
6.10 Chapter Summary	584
Chapter 7 — Introduction to Digital Forensics and Incident Response	588
7.1 Introduction to Digital Forensics and Incident Response	589
7.2 Evidence Collection and Preservation	598
7.3 Windows Forensic Artifacts	607
7.4 Memory Forensics and Live Response	617
7.5 Network Forensics and Packet Analysis	627
7.6 Timeline Analysis and Incident Reconstruction	637
7.7 Incident Reporting and Executive Communication	647
7.8 Digital Forensics and Incident Response Capstone	658
7.9 Chapter Summary	667
Chapter 8 — Security Operations Automation	671
8.1 Security Operations Automation	672
8.2 Security Orchestration, Automation, and Response (SOAR)	679
8.3 Artificial Intelligence in Security Operations Centers	689
8.4 AI-Assisted Detection Engineering and Threat Hunting	699
8.5 Enterprise Security Operations: Architecture, Evolution, and the Future	708
8.6 Chapter Summary	716
Chapter 9 — Operating the Platform	720
9.1 The Indexer, Retention, and Capacity	721
9.2 Security Configuration Assessment	724
9.3 Vulnerability Detection	725
9.4 The Wazuh API	726
9.5 Agent Groups and Centralized Configuration	727
9.6 Onboarding a New Log Source	728
9.7 Sensor Health and Capture Integrity	731
9.8 Detection as Code	732
9.9 The Operational Cadence	734
9.10 Chapter Summary	734
Appendix A — Building the Complete Enterprise Cybersecurity Lab	929
Appendix B — Wazuh Administrator Command Reference	980
Appendix C — SOC Operational Readiness Validation (ORV) Procedure and Checklist	987
Appendix D — SOC Operational Readiness Validation (ORV) Troubleshooting and Recovery Guide	992
Appendix E — Resetting the Lab for a New Investigation	1002
Appendix F. Version Pinning and Update Control	1011
Analyst Tools Reference (Appendix G)	1022
Glossary	1044
References	1048

Table of Contents