Defensive / Blue

Wazuh

Open-source XDR/SIEM platform for log analysis and FIM.

intermediate

Linux

Docker

Defense

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Building a free detection stack in a home lab.

Deploy manager + agents; create rules; alert on attacks you run.

Purple team feedback loop in your own lab.

Commands & usage

# Use official Docker all-in-one or step-by-step install

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Sigma Rules

Generic detection rule format convertible to SIEM queries.

osquery

SQL-powered endpoint visibility agent.

Suricata

Network IDS/IPS and network security monitoring engine.

Fail2ban

Bans IPs that show malicious signs (e.g., too many SSH failures).