🔧 From Setup to Signal: Building My First Wazuh SIEM with Sysmon and Atomic Red Team

Introduction


Setting up a SIEM sounds simple until you have to prove that it is actually seeing what you think it is seeing. For this project, I added Wazuh and Sysmon monitoring to an Atomic Red Team workstation, then used safe attack simulations to trace activity from the Windows endpoint into the SIEM.

Two of my experiments produced clear,...