Building and Testing a Wazuh SIEM with Sysmon

Introduction

• Detecting the Details: My Wazuh SIEM Deployment Project

In this project, I improved a Wazuh SIEM deployment by tuning Sysmon logging on a Windows endpoint and testing how well the environment captured process activity, network connections, and behavior related to MITRE ATT&CK techniques. I also used Wazuh Discover and the MITRE ATT&CK dashboard to investigate the events generated during my experiments.

My name is Jason Hunter, and I am building my skills in cybersecurity through hands-on projects involving SIEMs, endpoint monitoring, log analysis, and threat detection. This project gave me the opportunity to work with Wazuh and Sysmon in a realistic lab environment and practice the same types of investigation and documentation skills that are important in cybersecurity roles. I am especially interested in learning how security tools can turn raw endpoint activity into useful information that analysts can use to detect and investigate suspicious behavior.

Setup

For my SIEM modification, I updated the Sysmon configuration on the Windows endpoint ad01 to improve visibility into process and network activity being forwarded to Wazuh. Before making the change, I reviewed the existing Sysmon configuration and confirmed that ad01 was already sending events to Wazuh.

I then updated the Sysmon configuration to improve logging for important activity such as process creation, process access, and network connections. After applying the updated configuration, I generated activity on ad01 by opening applications and creating network connections.

To verify the modification, I first checked Windows Event Viewer under the Sysmon Operational log. I then opened Wazuh Discover, filtered the results for the ad01 agent, and searched for matching Sysmon events.

The modification was successful when the Sysmon events generated on ad01 appeared in Wazuh with information such as process names, command-line data, timestamps, IP addresses, ports, and other event details. This confirmed that Sysmon was recording the activity and that Wazuh was successfully collecting the telemetry.

One mistake I made during the validation process was assuming that the logging configuration might have failed when I could not immediately find an expected event in Wazuh. I checked Windows Event Viewer and confirmed that Sysmon had actually recorded the event. I then realized that the issue was related to the time range and filters I was using in Wazuh Discover. After adjusting the time range and filtering specifically for ad01 and the appropriate Sysmon fields, I was able to find the event.

This taught me that I should verify the event on the endpoint before assuming that the SIEM or configuration is not working. It also showed me how important the correct time range and filters are during log analysis.

Experiment Time

Experiment #1: Process Activity

For my first experiment, I tested whether Sysmon and Wazuh could capture process activity on the ad01 Windows endpoint. I launched applications such as Command Prompt and Notepad and then reviewed the Sysmon Operational log in Windows Event Viewer.

After generating the activity, I opened Wazuh Discover and filtered the logs for the ad01 agent. I looked for process-related information such as the process name, command line, parent process, user, timestamp, and Sysmon Event ID.

The process activity was successfully recorded by Sysmon and appeared in Wazuh. The events contained useful process information that could be used during an investigation. This confirmed that Wazuh was receiving process telemetry from ad01.

Experiment #2: Network Activity

For my second experiment, I tested whether Sysmon and Wazuh could capture network connection activity from ad01. I generated a network connection from the Windows endpoint to another system or service in the lab environment.

I then reviewed the Sysmon logs and Wazuh Discover for network-related activity. I focused on information such as the source IP address, destination IP address, source and destination ports, protocol, and the process responsible for the connection.

Network-related events were visible in Wazuh and contained information about the connection, including IP addresses, ports, protocol, and process details. This showed that the SIEM could provide useful network telemetry for investigating activity from the endpoint.

Experiment #3: MITRE ATT&CK T1105

For my third experiment, I tested activity related to MITRE ATT&CK technique T1105, Ingress Tool Transfer, using Atomic Red Team in the lab environment.

After running the test, I searched Wazuh Discover for events generated by the activity and reviewed the Wazuh MITRE ATT&CK dashboard. I looked for process and transfer-related telemetry that could be connected to the test.

Wazuh recorded events generated during the experiment and provided process and activity information that could be used to investigate the simulated behavior. The MITRE ATT&CK dashboard also provided context for activity related to T1105, showing how SIEM telemetry can be connected to known attacker techniques.

During one of the experiments, I initially could not find the event I expected in Wazuh. At first, I thought the experiment or logging configuration had failed. I checked Windows Event Viewer and confirmed that Sysmon had recorded the activity. I then realized that the issue was caused by my Wazuh search settings. After adjusting the time range and filtering specifically for the ad01 agent and relevant Sysmon fields, I was able to locate the event.

This reinforced the importance of confirming endpoint activity first and then checking the SIEM search configuration before assuming that data collection has failed.

Conclusion

Overall, the experiments showed that the Wazuh SIEM was able to collect and display useful Sysmon telemetry from the ad01 Windows endpoint. The first experiment confirmed that process activity could be recorded and investigated using fields such as process name, command line, parent process, user, timestamp, and Sysmon Event ID. The second experiment showed that network activity could also be reviewed in Wazuh using details such as source and destination IP addresses, ports, protocol, and the process responsible for the connection. The third experiment demonstrated how activity related to MITRE ATT&CK T1105, Ingress Tool Transfer, could be investigated using Wazuh Discover and the MITRE ATT&CK dashboard.

Together, these tests showed that improving Sysmon logging increased the amount of useful endpoint telemetry available in Wazuh and made it easier to investigate both normal and potentially suspicious activity.

One of the most important lessons from this project was not to assume that a missing event means the SIEM or configuration has failed. If an event does not appear in Wazuh, I would first verify that the event exists locally in Windows Event Viewer. After confirming that Sysmon recorded it, I would check the Wazuh time range, agent filter, event fields, and other search settings before changing the configuration.

I would also recommend making one configuration change at a time and documenting each change. This makes troubleshooting more organized and helps prevent unnecessary configuration changes when the actual problem may only be the way the logs are being searched.

Final Thoughts

The Coolest Thing I Learned

The coolest thing I learned during this project was how endpoint activity can be turned into useful security information inside a SIEM. Seeing Sysmon events from ad01 appear in Wazuh made it easier to understand how analysts can trace process activity, network connections, and behavior associated with MITRE ATT&CK techniques. It helped connect the technical actions I was performing in the lab with the type of evidence a security analyst would actually investigate.

One Piece of Advice

My advice to someone completing a similar project would be to verify each step before moving on. If an event does not appear in Wazuh, first check Windows Event Viewer to confirm that Sysmon recorded it. Then check the time range, filters, agent name, and event fields in Wazuh. This makes troubleshooting much easier and prevents you from changing a configuration that may already be working correctly.

My Favorite Resource

My favorite resource during this project was the Wazuh documentation because it helped me understand how endpoint events are collected, searched, and analyzed inside the SIEM. I also found the MITRE ATT&CK documentation useful because it explained techniques such as T1105 and helped connect the lab activity to real-world attacker behavior.

Thank You

I would like to thank my TripleTen instructors and tutors for providing guidance throughout the project and helping me understand how to approach SIEM deployment and testing.

I would also like to thank the cybersecurity community and the developers behind tools such as Wazuh, Sysmon, MITRE ATT&CK, and Atomic Red Team for creating resources that make it possible to practice realistic security monitoring and detection techniques in a lab environment.

References

1. Sysmon

Title: Sysmon – Sysinternals

Author: Microsoft Sysinternals

Affiliation: Microsoft

Use in this project: Used to understand process creation, network connection, and other Windows telemetry generated by Sysmon.

2. Wazuh Log Collection

Title: Configuring Log Collection for Different Operating Systems

Author: Wazuh Documentation Team

Affiliation: Wazuh

Use in this project: Used to understand how Wazuh collects Windows event logs and endpoint telemetry.

3. Wazuh Log Analysis

Title: Log Data Analysis – Use Cases

Author: Wazuh Documentation Team

Affiliation: Wazuh

Use in this project: Used to understand how endpoint events can be searched and analyzed in Wazuh.

4. MITRE ATT&CK T1105

Title: Ingress Tool Transfer – Technique T1105

Author: MITRE ATT&CK

Affiliation: The MITRE Corporation

Use in this project: Used to understand the T1105 technique and how tool-transfer activity can relate to adversary behavior.

5. Atomic Red Team T1105

Title: Atomic Red Team – T1105 Ingress Tool Transfer Tests

Author: Red Canary / Atomic Red Team

Affiliation: Red Canary

Use in this project: Used to understand how Atomic Red Team can simulate activity associated with MITRE ATT&CK T1105 for detection testing.