What happens when a web server captures an attack in its access logs, but the underlying host system remains completely blind to the actual commands being run? Setting up a Security Information and Event Management (SIEM) platform is not just about turning on a tool and watching a dashboard. It is about engineering true visibility and discovering where critical telemetry gets lost. In this post, we will look at configuring custom container log ingestion in a Wazuh SIEM environment on play-server, executing live reconnaissance and command injection attacks against Damn Vulnerable Web Application (DVWA), and auditing post-exploitation persistence. We will then see how these configurations perform under real testing and where logging breakdowns occur.
My name is Joseph, and before entering the cybersecurity field, I worked for four years as a residential house painter. Painting taught me that quality always comes down to surface preparation—if you skip sanding and priming, the topcoat fails under stress. That exact principle translates directly into security operations. Plumbing log pipelines, fixing permission blocks, and making sure your sensors actually capture threat activity is the SOC equivalent of prep work. Deploying and tuning this SIEM environment has been one of the most rewarding parts of my learning journey, and I hope this write-up helps anyone looking to build and audit their own detection lab.
