Skip to content
Writeups

Notes from the lab

Investigations, detection engineering, and CTF writeups. Each one documents the reasoning, not just the result.

2 min

Building a Home SOC Lab with Wazuh: Detecting SSH Brute-Force

How I stood up a single-node Wazuh SIEM on Ubuntu Server and validated a full detection pipeline — from raw SSH auth logs to a correlated brute-force alert mapped to MITRE ATT&CK T1110.

Home Lab
Wazuh
MITRE ATT&CK
Detection