Completed Case Study
Build a SOC Lab with Wazuh | AI-Assisted SOC Triage
A SOC engineering case study that starts with Wazuh monitoring, Windows/Linux endpoint telemetry, File Integrity Monitoring, custom rules and Active Response, then extends the workflow with local AI-assisted Tier 1 triage under deterministic policy control and human oversight.
Telemetry • Detection Engineering • Local AI • Validation
Objective
Build a beginner-friendly SOC lab using Wazuh, validate telemetry from Windows and Linux endpoints, create analyst-focused dashboards and detections, then document an investigation workflow with evidence, findings, 5W1H analysis and recommendations.
Environment
The lab used VMware Workstation / VMnet8 on 10.1.10.0/24, a dedicated Wazuh server at 10.1.10.50, a Windows endpoint with Wazuh Agent and Sysmon, a Linux endpoint with Wazuh Agent, Linux Sysmon, SSH and FIM, plus a local Ubuntu host later reused for Ollama/Qwen AI testing.
Wazuh implementation
Deployed Wazuh as the central collection and analysis platform, enrolled Windows and Linux agents, validated event communication and enrollment, enabled archives, integrated Sysmon telemetry and built custom SOC dashboard views for severity, account-management and SSH activity.
Detection engineering
Created and tested custom Wazuh rules for Windows Guest account enablement, Remote Desktop Users membership changes and repeated SSH login failures. The SSH correlation rule triggered Active Response using firewall-drop against the source of repeated authentication failures.
AI-assisted extension
Extended the project with a local AI-assisted triage pipeline using Ollama, Qwen 2.5, structured JSON test cases, human ground truth, a SOC playbook, Python policy engine, output validator, evaluator and benchmark summary.
Outcome
The final model keeps authority separated: Wazuh detects, Python enforces known facts, AI explains and recommends, and the human analyst remains the final decision authority. The project demonstrates SOC lab engineering, incident investigation, detection validation, automation and AI governance.