Building a Home SOC Lab with Wazuh and Sysmon
A practical explanation of how a controlled SOC lab can collect Windows endpoint telemetry, support alert investigation, validate detections, and document analyst workflows.
A home SOC lab is useful when it is treated as a controlled evidence environment—not as a miniature enterprise. My goal is to understand how endpoint activity becomes searchable telemetry, how alerts inherit context, and where that chain can fail.
Why a home SOC lab matters
Reading about event IDs is different from investigating an alert whose supporting event never arrived. A lab makes the full path visible: collection, transport, parsing, rule evaluation, investigation, and reporting. It also provides a safe place to repeat tests and document what changed.
Basic architecture
The environment uses a Windows endpoint with Sysmon, a Wazuh manager, and the Wazuh search and analysis interface. Sysmon enriches native Windows visibility with process, network, and file-related events. Wazuh collects those events and applies rules that can surface activity for review.
This is a lab-based design. It does not reproduce enterprise scale, identity architecture, retention, or operational constraints.
Telemetry I care about
For endpoint investigations, the most useful evidence often includes process creation, parent-child relationships, command-line arguments, user and host context, hashes, network destinations, and timestamps. Authentication events and configuration changes become important when an alert suggests privilege or persistence-related behavior.
The important question is not simply whether an event exists. I check whether it arrives on time, is parsed consistently, and retains the fields an analyst needs.
Supporting detection testing
A detection test begins with an expected behavior and its required evidence. I record the relevant data source, expected fields, rule outcome, and observed result. If no alert appears, I separate collection failures from parsing, ingestion, and rule-logic failures before changing the detection.
Common troubleshooting areas
- Sysmon configuration does not capture the expected event category.
- The endpoint agent is disconnected or delayed.
- Fields are renamed or nested differently after parsing.
- A rule expects data that the source never provides.
- Time differences make correlation misleading.
These failures are valuable because they expose the assumptions behind a detection.
What the lab demonstrates
The lab demonstrates a repeatable investigation mindset: preserve evidence, verify telemetry, explain detection logic, and document limitations. My public Blue Team Portfolio contains lab-based notes and defensive work produced in controlled environments.
Conclusion
A useful home SOC lab is less about the number of tools and more about traceability. Every alert should lead back to evidence, and every failed alert should lead to a testable explanation.