SIEM Dashboard & Detection Rules Project
Part of the Cybersecurity Roadmap
In short
Building your own SIEM, feeding it logs and writing rules that catch real lab activity is about as close to SOC work as you can get before your first job.
Set up a SIEM instance, ingest sample logs, and build custom detection rules — demonstrating Phase 7's SOC and detection engineering skills hands-on.
Think of it like this
The mall's CCTV control room
A mall control room has dozens of screens. Nobody can stare at all of them, so the system flags odd things: a door forced at 2 am, someone loitering by the cash counter. A SIEM dashboard with detection rules is that control room for your logs.
Watch it happen
Build plan
1/6Install Wazuh, or Elastic with Kibana, on a VM in your lab's management segment.
The big ideas
What you need to know
Test every rule
A rule you never saw fire is a guess. Document how you triggered each one in the lab.
Tune false positives
Note what normal activity caused noise and how you filtered it. That is real detection engineering.
Map to ATT&CK
Tag each rule with a MITRE ATT&CK technique so readers see what behaviour it covers.
Rules as code
Keep rules in git, ideally in a portable format like Sigma, with a test note for each.
See it in code
Walk through the code
1title: SSH Failed Password Logins2status: test3description: Failed SSH password attempts on lab Linux hosts4references:5 - https://attack.mitre.org/techniques/T1110/6logsource:7 product: linux8 service: auth9detection:10 keywords:11 - 'Failed password for'12 condition: keywords13falsepositives:14 - Users mistyping their own password15level: low1/4A clear title and description so analysts know what fired.
A simple Sigma rule. Sigma is a vendor neutral format that converts to many SIEM query languages. Set the count threshold in your SIEM's alerting.
Save yourself the pain
Common mistakes
Oops
Showing only a pretty dashboard with no rules behind it.
Do this instead
Detections are the real skill. Show each rule, how you tested it and how you tuned it.
Oops
Generating test events with real attacks on outside systems.
Do this instead
Create activity only inside your own lab VMs, like failed logins to your own machine.
Your mission
First milestone: one rule fires
Quick check
What is the main benefit of writing detection rules in Sigma?
Go deeper
- 1Set up a free/local SIEM instance and ingest a sample dataset of logs.
- 2Build 2-3 custom detection rules targeting specific suspicious patterns.
- 3Document your rules' logic and test them against both malicious and benign sample data.
More projects at this stop
Home Lab Setup & Network Segmentation Project
CTF (Capture the Flag) Writeups
Vulnerability Assessment Report
Security Automation Script Project
Incident Response Tabletop Writeup
Portfolio Website or GitHub Showcase
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
