SIEM Deployment & Threat Detection

📜 Overview

Deployed a SIEM solution (Wazuh/ELK/Graylog) to monitor security logs, detect threats, and respond to incidents.

🛠️ Tools Used

• Wazuh
• ELK Stack (Elasticsearch, Logstash, Kibana)
• Graylog (Optional)
• Splunk Free (Optional for demo)

🔍 Process

1. Set up SIEM server.
2. Configure log collection from endpoints, firewalls, and servers.
3. Develop correlation rules for brute force, malware, lateral movement.
4. Build dashboards for threat monitoring.

📊 Results

• Detected multiple test attacks from simulated tools.
• Enhanced visibility into network activity.

📂 Files

• siem-architecture.png
• sample-log-data.json
• correlation-rules.yaml
• dashboards-screenshot.png
• SIEM-deployment-guide.md