Lion Cipher Lab
Write a custom Wazuh decoder and rule
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Deploying Wazuh gave you a SIEM that already understands thousands of common log formats. But the moment you point it at something the vendor never wrote a rule for — a homegrown app, an odd appliance, a niche service — the events arrive as raw text and light up nothing. Detection engineering is the craft that closes that gap, and it is what actually separates someone who 'has a SIEM' from someone who runs one. This lab walks the full loop on a log Wazuh does not understand: you write a decoder to pull structured fields out of the raw line, prove it with wazuh-logtest before it ever touches…
What you'll learn
- how the Wazuh pipeline works: log -> decoder extracts fields -> rule matches and alerts
- writing a custom decoder with prematch / regex / order to extract named fields
- testing a decoder and rule with wazuh-logtest before shipping it
- writing a custom rule in the safe user id range (>= 100000) with a level, description, and MITRE ATT&CK id
- building a brute-force correlation rule with frequency / timeframe / same_source_ip
- tuning detections to avoid noise and reasoning about decoder ordering
Steps in this lab
- The pipeline: how a raw log becomes an alert
- Capture the log line Wazuh does not understand
- Write the custom decoder
- Test the decoder with wazuh-logtest (the heart of the loop)
- Write the custom rule (safe id range, level, MITRE)
- Retest, restart, and fire the event for real
- Confirm the alert landed
- Tune it — and why you write your own detections