SIEM Deployment & SOC Detection Lab
Self-directed — VMware multi-VM environment (Wazuh + Kali Linux)
A full Wazuh SIEM stack — manager, indexer and dashboard — built from scratch on Ubuntu with a monitored Linux endpoint enrolled, then used to build and validate three end-to-end detection scenarios covering vulnerability, malware and intrusion detection.
Scope
An isolated VMware environment of my own building: a Wazuh server on Ubuntu running the manager, indexer and dashboard tiers, one monitored Ubuntu 24.04 endpoint with the agent enrolled, and a Kali Linux host to generate attack traffic. Everything tested is my own infrastructure — no third-party systems were involved at any point.
Vulnerability detection & configuration assessment
Ran a CIS Ubuntu 24.04 benchmark assessment against the monitored host and prioritised the failed checks by severity rather than working top-to-bottom. Applied hardening across kernel modules, audit logging (auditd), SSH configuration, network sysctl parameters and file permissions, then re-scanned to verify. The compliance score moved from 47% to 61% — 127 to 168 checks passing. The checks I deliberately did not fix are documented with a risk-acceptance rationale, because a benchmark score you cannot explain is not worth having.
Malware detection with threat intelligence
Configured File Integrity Monitoring on a watched directory and wired it to VirusTotal enrichment, so any new or modified file triggers an automatic hash-reputation lookup. Dropping an EICAR test file into the directory produced a malicious verdict and an alert without manual intervention.
Brute-force intrusion detection
Launched a Hydra SSH brute-force attack from the Kali host and traced the entire detection pipeline end to end — raw log, decoder, correlation rule, alert. Analysed the resulting alerts both in the Discover interface and directly in alerts.json, then mapped the observed activity to MITRE ATT&CK techniques T1110 (Brute Force) and T1203.
Infrastructure ownership
Provisioned and networked the VM estate, enrolled the agents, and kept the manager, indexer and dashboard tiers healthy through the build — the same install, configure, monitor and document discipline I apply to production infrastructure.
What I would do differently
The next iteration of this lab adds a Windows endpoint with Sysmon, because most of the estates I have worked in are Windows-first, and the detection content that matters to a real SOC lives there.
Let's talk about the hard part.
Open to SOC Analyst, Security Analyst and Blue Team roles. Based in Dhaka, Bangladesh, and comfortable with distributed teams across time zones — I have spent three years working daily with a head office in Japan.
Open to IT Engineer, Network Engineer and Systems Infrastructure roles. Based in Dhaka, Bangladesh, and comfortable with distributed teams across time zones — I have spent three years working daily with a head office in Japan.