Personal practice · Cybersecurity
Security practice labFrom a signal to an investigation.
An alert alone does not explain an incident. I am learning to connect system activity with its logs and context before deciding what to investigate.
Role & scope
Personal, isolated Linux and monitoring practice. The repository records the environment; evidence for a reproducible exercise is still being prepared.
How does it work?
- Training environment
Linux virtual machines in VirtualBox, with Kali as a workstation and Ubuntu as a test system.
- Observation
Wazuh for events and network tools for connectivity and traffic.
- Interpretation
Compare the source, timing and expected behavior before drawing a conclusion.
The decisions behind it
What does the diagram represent?
A logical view of the components recorded in the public project, not exact network settings or addresses. VM disks and raw system data are not published.
What evidence would complete the study?
One exercise documenting the objective, expected event, actual observed record, interpretation and possible false-positive context. That evidence is not yet published; the fictional examples below do not replace it.
Inspect the work.
The public project record and validation worksheet are linked below. These examples practise reasoning; they are not real incident logs or production SOC experience.
Synthetic training log
What needs a closer look?
Check the source and timing first. Repetition alone does not prove an attack.
An educational diagram. No real alerts or incident data.
Linux
Wazuh