Bridging Theory and Practice
Security tools like Wazuh and Sysmon are designed to catch common malware out of the box, but they'll quickly flood log storage with useless alert noise. You don't get real visibility that way. Security teams have to actively modify policies and write custom rules just to catch threats lurking in the shadows. To make matters worse, indicators like credential dumping, log clearing, and persistence mechanisms hide in plain sight as low-severity events, if they trigger an alert at all. For this project, I modified a pre-built lab environment to see what it takes to cut through the log clutter and validate how well a SIEM can catch active adversary techniques and turn them into concrete, actionable alerts. By the time I finished, I'd learned some surprising lessons about where default rules fail and why tuning is everything.
Before we look more closely at this lab, it’s probably worth sharing my angle on all this. My main motivation for getting into cybersecurity was to be part of the team building the shield to stop data leaks and the chaos adversaries leave behind. Somewhere along the way, I realized my long-term goal is the analytical forensics side of DFIR. The idea of being the one to figure out the "what, where, and why" of an attack is what pulled me into this field. But to solve those high-stakes puzzles, you have to get down in the weeds where the data lives and make sure that you're seeing the logs and alerts that matter. Ultimately, that’s why I decided to focus this project on modifying Active Directory to separate the signal from the noise, ensuring that key events hit the centralized system to catch potential adversarial activity.
