@abishekvengei

Detecting Web Reconnaissance with Wazuh — Catching the Attack Before It Starts

Dec 23, 2025 · 3 min read · Most attacks don’t begin with exploitation.They begin with looking around. In this lab, I focused on detecting web reconnaissance activity — the phase where an attacker maps a target, tests endpoints, and looks for weaknesses. The idea was to see whe...

Incident Analysis: SSH Brute-Force Attack Detected by Wazuh

Dec 23, 2025 · 3 min read · This lab was designed to simulate a real credential-based attack and observe how a host-based SIEM behaves during high-volume abuse. Instead of focusing on dashboards, I treated this like an actual SOC incident: attack happens first, investigation co...

Coordinated Login Attack Detection with a Custom Alert Action (Splunk)

Dec 22, 2025 · 3 min read · This lab pushed me a bit outside my comfort zone. Until now, most of my Splunk work was about searches, dashboards, and alerts. Here, I wanted to answer a tougher question: What if the attack is distributed and doesn’t come from a single IP? That’s...

Threat Intelligence Alerting in Splunk — Making the SIEM Speak First

Dec 21, 2025 · 2 min read · After enriching Apache logs with a threat intelligence lookup, the next obvious question was: Why should I keep checking this manually? In a SOC, if a known bad IP appears in live traffic, the system should tell you — not the other way around.This ...

Threat Intelligence Correlation in Splunk — Practical Guide

Dec 20, 2025 · 3 min read · I wanted to test how useful simple threat feeds are when combined with live web logs. The goal was straightforward: upload a small threat feed, enrich Apache logs with it, and see whether I can quickly highlight risky IPs on a dashboard. This lab is ...