Enterprise SIEM lab using Elastic Stack for a dedicated SOC server, ingest endpoint logs, simulate different attack techniques, and create custom detection rules mapped to MITRE ATT&CK for real-world alert investigation.
Read LabI built a Wazuh SIEM in Docker on my Mac (ARM64), added a Linux endpoint with the agent, and walked through generating real alerts.
Read LabContainer-based home lab on Raspberry Pi with Docker and Portainer—a secure, reproducible base for SIEMs, honeypots, IDS, and monitoring.
Read LabWhat I Learned:
What I Learned: