SIEM Threat Detection Lab

A hands-on security monitoring lab built in VMware to practice centralized log collection, threat detection, and incident response across a small simulated network. Logs from a Windows and a Linux endpoint are shipped to a dedicated SIEM host running Splunk and Wazuh, where custom rules flag suspicious activity and surface it on real-time dashboards.

This lab builds on my Active Directory Home Lab and reuses the same ridham.local domain controller as one of the monitored endpoints.

---

Network topology

Three virtual machines on an isolated 192.168.58.0/24 VMware network:

Role	Machine	Purpose
Monitored endpoint	Windows Server 2019	Domain controller (ridham.local), forwards security and event logs
Monitored endpoint	Ubuntu Linux	Endpoint host, forwards syslog and authentication logs
SIEM host	Dedicated VM	Runs Splunk and Wazuh for ingestion, detection, and dashboards

---

Detection pipeline

Every event follows the same path: it is generated on an endpoint, ingested and indexed by Splunk, matched against a Wazuh detection rule, raised as an alert on a dashboard, and then triaged and responded to.

---

Detection coverage

I wrote 12+ custom detection rules grouped around three common attack patterns:

• Brute-force attempts — repeated failed logins across endpoints
• Privilege escalation — unexpected changes to admin rights and group membership
• Unauthorized access — attempts to reach restricted resources

---

PowerShell automation

I used PowerShell to prepare the environment and to generate the activity that validates each detection rule, so testing was repeatable instead of manual. Full scripts and details are in scripts/.

Script	Purpose
Enable-AuditPolicy.ps1	Enables the Windows audit categories (logon, account management, object access) the SIEM needs to see events
Test-BruteForce.ps1	Generates a burst of failed logons to trigger the brute-force rule
Test-PrivilegeEscalation.ps1	Adds and removes a user from Administrators to trigger the privilege escalation rule
Test-UnauthorizedAccess.ps1	Attempts to read a restricted folder to trigger the unauthorized-access rule

Each test script maps directly to one of the detection categories, so I could fire an event and immediately confirm the rule and dashboard responded.

---

Simulated attack scenarios

I ran 5 attack scenarios through the full detection pipeline and documented each one end to end, from the triggering event to the response steps.

---

Monitoring dashboards

Four dashboards give a real-time view of authentication activity, failed-login sources, alerts by category, and the most recent alerts on the network.

---

Lab evidence

Real output from the running lab. Full set in screenshots/.

Windows Security logs ingesting into Splunk from the domain controller

Events indexed from two hosts

---

Skills demonstrated

Splunk · Wazuh · SIEM · Log Ingestion · Threat Detection · Incident Response · Windows Server 2019 · Linux · VMware · Security Event Analysis

---

Repository structure

SIEM-Threat-Detection-Lab/
├── README.md
├── diagrams/
│   ├── 01-network-topology.svg
│   ├── 02-detection-pipeline.svg
│   ├── 03-attack-scenarios.svg
│   └── 04-dashboard-overview.svg
├── scripts/
│   ├── Enable-AuditPolicy.ps1
│   ├── Test-BruteForce.ps1
│   ├── Test-PrivilegeEscalation.ps1
│   ├── Test-UnauthorizedAccess.ps1
│   └── README.md
├── detection-rules/
│   └── README.md
├── incident-response/
│   └── README.md
└── screenshots/
    ├── 01-vm-ip-and-ping.png
    ├── 02-splunk-receiver-port-9997.png
    ├── 03-splunk-web-ui.png
    ├── 04-security-logs-ingesting.png
    ├── 05-events-by-host.png
    └── README.md

---

Related labs

• Active Directory Home Lab — the domain and identity foundation this lab monitors