Lion Cipher Lab
Deploy Wazuh (open-source SIEM) and enroll your first agent
- SOC Analyst / Blue Team
- Beginner
- ~60 min
- Free · no account required
Why it matters
The centralize-your-logs lab taught the core idea of a SIEM by forwarding logs to one place by hand. This lab is the payoff: you stand up an actual SIEM/XDR platform and watch it do the parts you built by hand — plus the parts you could not. Wazuh is free and open source, runs entirely on hardware you own, and gives you the exact loop a real security operations center lives in: agents collect from every machine, a manager parses and applies detection rules, and a dashboard shows you alerts already enriched with severity and MITRE ATT&CK technique IDs. Doing this once turns 'a SIEM collects,…
What you'll learn
- what a SIEM/XDR is made of (agents, manager, dashboard)
- deploying Wazuh with Docker
- enrolling an agent on a machine you own
- generating benign test events on purpose
- reading security alerts, file-integrity events, and MITRE ATT&CK mappings in a dashboard
Steps in this lab
- What Wazuh actually is
- What you need before you start
- Stand up the Wazuh server with Docker
- Log into the dashboard
- Enroll an agent on a machine you own
- Generate benign events on purpose
- Read the alerts in the dashboard
- You just ran the loop a SOC lives in