Overview

Built a SOC incident response and vulnerability management lab to simulate the day-to-day responsibilities of a security operations team. The environment combined endpoint telemetry, SIEM monitoring, attack simulation, vulnerability scanning, MITRE ATT&CK mapping, and ticket-based remediation across eight Windows and Linux endpoints.

The project focused on the complete security operations lifecycle rather than individual tools: generating security events, detecting suspicious activity, investigating alerts, determining severity, documenting evidence, identifying vulnerable systems, prioritizing remediation, and tracking work through closure.

Objectives

• Centralize security monitoring across Windows and Linux endpoints.
• Collect detailed endpoint and authentication telemetry for investigation.
• Simulate realistic attacks and investigate the resulting alerts.
• Map observed attacker behavior to the MITRE ATT&CK framework.
• Perform authenticated vulnerability assessments with Nessus.
• Prioritize vulnerabilities using severity, exploitability, and system context.
• Track incidents and remediation work through GLPI.
• Practice repeatable SOC triage and vulnerability management workflows.

Environment

Security Stack

• Wazuh SIEM and endpoint agents
• Microsoft Defender Antivirus
• Microsoft Sysmon
• Nessus vulnerability scanner
• GLPI for incident and vulnerability tracking
• MITRE ATT&CK framework
• Windows and Linux virtual machines
• Kali Linux for controlled attack simulation

Endpoint Environment

Deployed Wazuh agents across eight Windows and Linux endpoints to provide centralized visibility into security events. Windows systems also used Microsoft Defender and Sysmon to generate additional endpoint telemetry for suspicious processes, authentication activity, network connections, and other host-level events.

The combination of native operating system logs, Defender detections, Sysmon telemetry, and Wazuh monitoring provided multiple sources of evidence during investigations rather than relying on a single alert.

Security Monitoring Architecture

Centralized Wazuh Monitoring

Configured Wazuh as the central security monitoring platform for the lab. Endpoint agents forwarded security and system telemetry to the Wazuh server, where events could be correlated, assigned severity levels, and investigated from a centralized dashboard.

Monitoring covered activity such as:

• Successful and failed authentication attempts
• Account and privilege-related events
• Suspicious process execution
• PowerShell and command-line activity
• File and configuration changes
• Microsoft Defender detections
• Sysmon process and network telemetry
• Linux authentication and system events

This provided a central location for identifying suspicious activity across otherwise separate Windows and Linux systems.

Sysmon Telemetry

Installed Sysmon on Windows endpoints to provide more detailed visibility than standard Windows logging alone. Sysmon telemetry was forwarded into the monitoring environment and used during investigations to reconstruct endpoint activity.

Relevant events included process creation, parent-child process relationships, command-line arguments, network connections, file activity, and other system behavior useful for determining what occurred before and after an alert.

Microsoft Defender

Kept Microsoft Defender enabled on Windows endpoints as an additional detection layer. Defender alerts and protection events were reviewed alongside Wazuh and Sysmon data to compare endpoint detection with centralized SIEM telemetry.

Using multiple telemetry sources made it possible to validate detections and gather additional context when determining whether an event represented malicious activity or expected system behavior.

Attack Simulation and Detection

Controlled Attack Scenarios

Used Kali Linux and controlled endpoint activity to generate security events against lab systems. Simulations were designed to produce telemetry representative of activity a SOC analyst could encounter during an investigation.

Test scenarios included activities such as:

• Repeated failed authentication attempts
• Password and account attacks
• Network reconnaissance and scanning
• Suspicious PowerShell or command execution
• Potentially malicious process execution
• Security configuration changes
• Unauthorized or abnormal access attempts

All testing was isolated to systems within the homelab.

Alert Validation

After each simulation, reviewed Wazuh alerts and supporting endpoint telemetry to determine whether the activity had been detected correctly.

Rather than treating every alert as an incident, investigated the surrounding context to determine:

• Which endpoint generated the alert
• Which account or process was involved
• When the activity occurred
• What commands or processes were executed
• Whether network activity accompanied the event
• Which additional logs supported the detection
• Whether the event represented expected, suspicious, or malicious behavior

This created a repeatable workflow for moving from an initial alert to a documented conclusion.

Incident Investigation and Response

Alert Triage

Investigated and triaged more than 10 simulated security attacks across the environment. Alerts were reviewed based on severity, affected asset, event type, supporting evidence, and potential impact.

For each investigation, correlated relevant Wazuh, Sysmon, Defender, Windows, and Linux events where available instead of relying solely on the original detection.

Investigation Workflow

Used a structured process for each simulated incident:

1. Review the initial alert and severity.
2. Identify the affected host and user account.
3. Establish the event timeline.
4. Review related process, authentication, and network telemetry.
5. Determine whether the activity was expected or suspicious.
6. Identify the likely attack technique.
7. Assess the potential impact and scope.
8. Document evidence and recommended response actions.
9. Create or update the corresponding GLPI ticket.
10. Verify remediation before closing the incident.

This workflow helped separate detection from investigation and ensured that alerts were supported by evidence before remediation decisions were made.

MITRE ATT&CK Mapping

Mapped investigated behavior to relevant MITRE ATT&CK tactics and techniques. Instead of documenting an incident only by the name of the alert, ATT&CK mapping described the underlying attacker behavior represented by the observed telemetry.

Depending on the simulation, findings could be associated with behaviors related to reconnaissance, credential access, execution, persistence, privilege escalation, or defense evasion.

This made incident documentation more consistent and provided practical experience translating raw endpoint events into standardized adversary behavior.

Vulnerability Management

Authenticated Nessus Scanning

Configured Nessus to perform authenticated vulnerability scans against lab systems. Authenticated scanning allowed the scanner to inspect installed software, operating system configuration, missing patches, and other host-level conditions that could not be reliably identified through network scanning alone.

Scans produced more than 50 findings across the environment, ranging from informational observations to vulnerabilities requiring remediation.

Vulnerability Validation

Reviewed scan results before treating them as remediation tasks. Findings were evaluated using factors such as:

• Vulnerability severity
• CVSS information
• Exploit availability or exploitability
• Affected software or operating system
• Exposure of the vulnerable service
• Importance of the affected system
• Availability and impact of remediation
• Potential false positives or duplicate findings

This prevented prioritization from being based solely on the scanner’s severity rating.

Risk-Based Prioritization

Prioritized vulnerabilities according to both technical severity and practical risk. A high-severity vulnerability on an exposed or important system received greater attention than a similar finding on an isolated or low-impact endpoint.

Findings were grouped into remediation actions such as:

• Installing operating system security updates
• Updating vulnerable applications
• Removing unnecessary or obsolete software
• Disabling unused services
• Correcting insecure configurations
• Restricting unnecessary network exposure
• Applying vendor-recommended mitigations

Incident and Vulnerability Tracking with GLPI

Ticket Management

Used GLPI to document and track both security incidents and vulnerability remediation work. Tickets provided a record of what was detected, how it was investigated, what evidence was collected, and what actions were required.

Incident records included information such as:

• Affected endpoint or asset
• Alert description
• Severity and priority
• Investigation notes
• Supporting evidence
• MITRE ATT&CK mapping
• Recommended containment or remediation
• Resolution status

Vulnerability Remediation Tracking

Created remediation records for prioritized Nessus findings and documented the affected asset, vulnerability details, risk, evidence, and required corrective action.

This connected vulnerability scanning to an operational workflow rather than ending the process after generating a Nessus report.

Verification and Closure

After remediation, repeated relevant checks or scans to confirm that the issue had been addressed. Tickets were updated with verification evidence and closed only after the remediation could be validated.

This produced a lifecycle of:

Detection → Triage → Investigation → Remediation → Verification → Closure

Security Controls

The lab used several layers of monitoring and defensive controls rather than depending on a single security product.

Endpoint Security

• Microsoft Defender for Windows endpoint protection
• Sysmon for detailed Windows security telemetry
• Wazuh agents for centralized endpoint monitoring
• Operating system authentication and security logs

Monitoring and Detection

• Centralized Wazuh alerting
• Cross-source event correlation during investigations
• Process and command-line monitoring
• Authentication monitoring
• Network connection visibility
• MITRE ATT&CK-based classification

Vulnerability Management

• Authenticated Nessus scanning
• Risk-based vulnerability prioritization
• Documented remediation actions
• Post-remediation verification
• GLPI ticket tracking

Challenges and Lessons Learned

Distinguishing Alerts from Incidents

One of the main challenges was determining whether an alert represented malicious activity rather than assuming every detection required escalation. Reviewing process relationships, authentication history, network activity, and surrounding events demonstrated the importance of context during SOC triage.

Managing Alert Noise

Centralized endpoint monitoring generated significantly more data than individual endpoint logs. Filtering events by severity, host, user, timestamp, and event type was necessary to identify the telemetry relevant to each investigation.

Prioritizing Vulnerabilities

The Nessus results demonstrated that vulnerability count alone is not a useful measure of risk. A large number of findings can exist simultaneously, but remediation priority depends on severity, exploitability, exposure, asset importance, and available mitigations.

Closing the Remediation Loop

Scanning and detection were only the beginning of the workflow. Tracking findings in GLPI and verifying remediation made the project more representative of an operational security environment where findings must be assigned, documented, corrected, retested, and formally closed.

Results

• Centralized security monitoring across eight Windows and Linux endpoints using Wazuh.
• Integrated Microsoft Defender and Sysmon telemetry into endpoint investigation workflows.
• Investigated and triaged more than 10 controlled attack simulations.
• Correlated authentication, process, network, and security events to reconstruct suspicious activity.
• Mapped simulated attacker behavior to relevant MITRE ATT&CK techniques.
• Performed authenticated Nessus vulnerability assessments across the lab environment.
• Reviewed and prioritized more than 50 vulnerability findings based on severity, exploitability, exposure, and asset context.
• Documented incident evidence, vulnerability findings, remediation actions, and resolution status in GLPI.
• Verified remediation through follow-up validation and rescanning.
• Built hands-on experience with SIEM monitoring, endpoint telemetry, SOC triage, incident investigation, vulnerability management, MITRE ATT&CK, and security ticketing workflows.