Project 3: Elastic SIEM Lab – Log Ingestion, Attack Detection, MITRE ATT&CK Mapping, Dashboards

Overview

I've had a blast building this lab and it has given me a great deal of insight into how SIEMs work. It simulates a real-world Security Operations Center (SOC) environment using the Elastic Stack as the SIEM platform. The project includes full SIEM deployment, endpoint log ingestion, attack simulation, custom detection rule creation, MITRE ATT&CK mapping, and creating some dashboards.

My goal is to demonstrate hands-on experience in building and operating a security monitoring environment from infrastructure setup all the way through threat detection and analysis.

I hope this motivates someone out there to build their own SIEM lab as it was a lot of fun (cheers fellow geeks!) and a great learning experience. If you do decide to build one, feel free to reach out, I'd love to hear what you did differently!

Architecture Design

Data flows from the attacker VM through the target endpoint into the SIEM:

Kali Linux VM (Attacker)
        ⬇
Ubuntu VM #1 (Target Endpoint)
        ⬇
Elastic Agent
        ⬇
Elasticsearch (SIEM Ubuntu Server)
        ⬇
Kibana Security Dashboard

• Kali Linux VM — Attacker machine used to simulate adversary techniques
• Ubuntu VM #1 — Target endpoint with Elastic Agent installed
• Elastic Agent — Collects and forwards logs/events to Elasticsearch
• Elasticsearch — SIEM backend on dedicated Ubuntu server; stores and indexes security data
• Kibana — Security dashboards, alert investigation, and detection rule management

Technologies Used

• Elastic Stack — Elasticsearch, Kibana
• Elastic Agent — Endpoint telemetry and log collection
• Kali Linux — Attacker VM for attack simulation
• Ubuntu Server Linux — SIEM server and target endpoint VM