Introduction
When I first started learning about Security Information and Event Management (SIEM) platforms, I understood the theory: collect logs from multiple systems, correlate events, and give defenders a centralized place to investigate suspicious activity. But understanding the theory is very different from watching those logs appear in real time after you've generated them yourself.
For this project, I deployed and enhanced a Wazuh SIEM environment in CloudShare and explored how Windows endpoint telemetry changes after tuning Sysmon. I wanted to answer a simple question: what does normal activity actually look like from a defender's perspective? To find out, I generated file system changes, administrative commands, and PowerShell activity, then watched how Wazuh collected, organized, and presented those events.
The technical side of the project was rewarding, but what surprised me most was how much I learned from the mistakes I made along the way. A couple of small configuration errors forced me to slow down, read documentation more carefully, and approach troubleshooting more methodically. Those moments ultimately taught me more than the experiments themselves.
My name is Michael Cooke, and I'm transitioning into cybersecurity after working in marketing and client-facing roles. This is my first contribution to the cybersecurity community, and I hope someone beginning their own blue team journey finds this story helpful—or at least avoids making a couple of the mistakes I did.
