← Back to projects

Enterprise Monitoring & Incident Response Homelab

In progress A homelab simulating a small enterprise environment to practice the core security-analyst workflow end to end: collect telemetry, detect suspicious activity, investigate, and document remediation. This page is the plan — the write-up will fill in with real findings as I build it.

Wazuh SIEMActive DirectoryWindows ServerLinuxSysmonWireshark

01 Goal

Build an isolated virtual environment that looks like a small enterprise network — Windows and Linux systems with centralized identity and centralized security monitoring — and use it to practice detecting and investigating realistic security events the way an analyst would on the job.

02 Planned architecture

Endpoint and system logs from each machine feed into a central SIEM, so events can be investigated across the whole environment rather than host by host.

ENTERPRISE HOMELAB ───────────────────────────────────────────── Security Monitoring Wazuh SIEM │ ┌───────────┼───────────┐ │ │ │ Windows Server Windows Linux Active Directory Client Server │ │ │ └───────────┼───────────┘ │ Security Telemetry Windows Event Logs · Sysmon · Linux Logs Authentication Events · Process Activity File Integrity Monitoring

03 Detection scenarios I plan to run

Repeated failed authentication attempts
Suspicious account activity
Privileged account and group-membership changes
Process and PowerShell activity
File integrity changes
Vulnerability identification and remediation
Network traffic analysis

04 Investigation workflow

Each simulated incident will follow a structured process, the same shape a SOC analyst uses:

Detection → Alert → Log Analysis → Investigation → Timeline → Findings → Remediation

05 Status

Live progressThis is where the real work lands as it happens — screenshots of the Wazuh dashboard, actual detections and their timelines, and remediation notes. I'll update it as each piece comes online, and the first blog post will be the build log.