A first endpoint-monitoring lab: deploy Wazuh in VirtualBox, connect a Windows agent, generate known account activity, and explain the resulting alerts without confusing a controlled test with a real incident.
I installed the Wazuh manager in a VirtualBox environment and reached its dashboard over my local network. I then deployed the Wazuh agent to my Windows laptop, named HAL9000 in the lab, and confirmed that its service was running with the required administrator permissions.
The objective was deliberately small: prove that a known action on the endpoint could become searchable security evidence, then practice the questions a SOC analyst should ask.
Contribution boundary
This is an owned home lab with one Windows endpoint. It is not production monitoring, professional SOC experience, or evidence of an external attack.
Lab managerWazuh running in the local VirtualBox environment
02 / Data path
Action to searchable alert
01Controlled Windows action
Create, enable, change, disable, and delete a local test account on HAL9000.
02Endpoint event collection
The running Wazuh agent forwards relevant Windows EventChannel data to the manager.
03Wazuh search and triage
Filter by host, timestamp, rule description, level, and rule ID to reconstruct what happened.
03 / Test
Generate known account activity
I created and later removed a local test user. Wazuh recorded the related account and group changes from HAL9000, including “User account enabled or created,” “User account changed,” and “User account disabled or deleted” entries.
Because I generated the activity myself, the event was expected and benign. The value of the exercise was learning to correlate the endpoint, time, event description, and surrounding changes instead of judging one alert in isolation.
Collected evidenceScroll horizontally on small screens to inspect the alerts
04 / Investigation
Turn the event into questions
Observed event
User account enabled or created on HAL9000 at June 10, 2026, 15:23:41.
Initial decision
Expected and benign because the account was created for this controlled test.
Why a SOC caresUnexpected accounts can create persistence
A new local user deserves context, especially if it receives elevated group membership.
What to correlateActor, groups, and later logins
Identify who created it, whether it joined Administrators, and whether authentication followed.
What evidence provesThe collection path worked
The endpoint action appeared under the correct host with related account and group events.
05 / Boundaries
Completed work versus next work
This lab verifies Wazuh deployment, Windows-agent connectivity, controlled event generation, search, and basic triage. It does not claim a completed Sysmon pipeline, custom detection engineering, MITRE ATT&CK mapping, or a full incident report.
The next defensible milestone is to ingest a Sysmon process-creation event, reproduce it from memory, correlate it with a Windows account event, and publish a structured investigation with evidence and response recommendations.
06 / Result
A small but complete evidence loop
The exercise established a working path from a Windows endpoint into Wazuh and a repeatable way to explain an alert: what happened, where, when, whether it was expected, why it matters, and what should be checked next.
