The best way to make the modules stick is to work with real tools and real evidence. These five projects take you from a SIEM home lab through malware traffic analysis in Wireshark, a Wazuh endpoint monitoring lab, a phishing alert investigation, and finally SOC automation with Shuffle.
Each one is a video walkthrough, so you can pause, repeat the steps yourself and adapt them to your own lab. Pick the project that matches the module you've just finished and come back for the rest. Run any lab on your own virtual machines, and only analyse malware captures inside an isolated environment.
Set up an Elastic security monitoring lab with a Kali Linux VM, install an agent, run a test Nmap scan, then build dashboards, alert rules, and email notifications. A hands-on drill for Log Analysis & SIEM.
Work through a real malware packet capture, examining DNS and HTTP traffic, extracted credentials, hidden executables, and TLS signatures. Practice for Network Traffic Analysis.
Set up a Wazuh all-in-one server with a Windows 10 agent, then view logs, trigger a test alert, and try file integrity monitoring. Practice for Endpoint Detection & Response.
Build your first Shuffle workflow that takes Wazuh alerts and automates case creation and analysis in TheHive. Practice for Automation & SOC Operations.