CyberSummer: from foundations to investigation.

Understand the system before trying to secure it

I completed TryHackMe’s Pre-Security path in Summer 2026. It helped me connect the pieces underneath a security alert: the computer running the software, the operating system recording activity, and the network carrying the traffic.

The seven modules covered:

• Introduction to Cyber Security: how offensive and defensive security differ, and the kinds of work people do in each.
• Computer Fundamentals: the hardware inside a computer and how those basics extend to cloud computing.
• Operating Systems Basics: working with Windows and Linux through both graphical interfaces and the command line.
• Software Basics: how software handles data, with introductory exercises in Python, JavaScript, and SQL.
• Network Fundamentals: how computers communicate and the weaknesses that can affect those connections.
• How the Web Works: what happens behind a website and how its underlying parts work together.
• Attacks and Defenses: how attackers and defenders approach a system, how data is protected, and how attacks and defenses work in practice.

I used those foundations in my own labs. With Pi-hole, I had to work out which DNS resolver a device was actually using. With Windows and Wazuh, I had to connect an action on the machine to the event it produced. Those were useful ways to find out whether I understood the system well enough to explain what I was seeing.

Inspect the telemetry directly

I installed Sysmon on my Windows machine and inspected its telemetry in Windows Event Viewer. I also examined native Windows Security logs and queried them with PowerShell.

Separately, in my Wazuh lab, I connected a Windows agent, generated known account activity, and traced the corresponding Windows EventChannel alerts. That demonstrated collection, search, and basic triage. My direct Sysmon practice does not establish a completed Sysmon-to-Wazuh ingestion or detection pipeline.

My Pi-hole investigation applied the same approach to DNS filtering, DHCP, IPv4/IPv6, and the network’s routing and gateway configuration.

Ask what the evidence supports

My Wazuh study became more specific: could it reliably detect suspicious PowerShell execution? What telemetry would support that detection, what assumptions would it make, and what could cause a false positive or false negative? These were investigation questions, not claims that I had built or validated those detections.

I practiced separating the raw event, the tool’s interpretation, my inference, and the final conclusion. The useful loop was to identify the telemetry, gather evidence, inspect the alert, verify the underlying activity, and consider alternative explanations before deciding what the evidence supported.

Keep up with what’s changing

Security has become something I follow outside my labs, too. As of September 2026, I’ve listened to more than 75 episodes of CyberWire Daily and plan to keep it in my routine. I also watch NetworkChuck and other technical creators, and listen to Darknet Diaries to explore security stories and unfamiliar technology in more depth.

The pace is part of the appeal: new vulnerabilities and attack techniques give me more questions to investigate. I want to understand what changed, which systems it affects, and what a defender would need to check. More on how I stay current →

Next steps

I plan to continue TryHackMe security training through Winter 2026–27. For Wazuh, the next milestone is to ingest a Sysmon process-creation event and correlate it with a Windows account event in a documented investigation.