--- title: "abishekvengeri (@abishekvengei) | Hashnode" description: "Hacking, Learning, Growing – My Cybersecurity Path. Read the latest articles by abishekvengeri on Hashnode." url: "https://hashnode.com/@abishekvengei" --- @abishekvengei # abishekvengeri @abishekvengei · kozhikode ,kerala · Joined April 2025 Hacking, Learning, Growing – My Cybersecurity Path. ### [Detecting Web Reconnaissance with Wazuh — Catching the Attack Before It Starts](https://abishekvengeri.hashnode.dev/detecting-web-reconnaissance-with-wazuh-catching-the-attack-before-it-starts?utm_source=hashnode&utm_medium=feed) Most attacks don’t begin with exploitation.They begin with looking around. In this lab, I focused on detecting web reconnaissance activity — the phase where an attacker maps a target, tests endpoints, and looks for weaknesses. The idea was to see whe... 3 min read · [abishekvengeri.hashnode.dev](https://abishekvengeri.hashnode.dev/detecting-web-reconnaissance-with-wazuh-catching-the-attack-before-it-starts?utm_source=hashnode&utm_medium=feed) [Dec 23, 2025](https://hashnode.com/posts/detecting-web-reconnaissance-with-wazuh-catching-the-attack-before-it-starts/694b1938d57de744df465ee8) ### [Incident Analysis: SSH Brute-Force Attack Detected by Wazuh](https://abishekvengeri.hashnode.dev/incident-analysis-ssh-brute-force-attack-detected-by-wazuh?utm_source=hashnode&utm_medium=feed) This lab was designed to simulate a real credential-based attack and observe how a host-based SIEM behaves during high-volume abuse. Instead of focusing on dashboards, I treated this like an actual SOC incident: attack happens first, investigation co... 3 min read · [abishekvengeri.hashnode.dev](https://abishekvengeri.hashnode.dev/incident-analysis-ssh-brute-force-attack-detected-by-wazuh?utm_source=hashnode&utm_medium=feed) [Dec 23, 2025](https://hashnode.com/posts/incident-analysis-ssh-brute-force-attack-detected-by-wazuh/694a0096b7f557552640c83a) ### [Coordinated Login Attack Detection with a Custom Alert Action (Splunk)](https://abishekvengeri.hashnode.dev/coordinated-login-attack-detection-with-a-custom-alert-action-splunk?utm_source=hashnode&utm_medium=feed) This lab pushed me a bit outside my comfort zone. Until now, most of my Splunk work was about searches, dashboards, and alerts. Here, I wanted to answer a tougher question: What if the attack is distributed and doesn’t come from a single IP? That’s... 3 min read · [abishekvengeri.hashnode.dev](https://abishekvengeri.hashnode.dev/coordinated-login-attack-detection-with-a-custom-alert-action-splunk?utm_source=hashnode&utm_medium=feed) [Dec 22, 2025](https://hashnode.com/posts/coordinated-login-attack-detection-with-a-custom-alert-action-splunk/6948ae65ba8c47f61f2f4b37) ### [Threat Intelligence Alerting in Splunk — Making the SIEM Speak First](https://abishekvengeri.hashnode.dev/threat-intelligence-alerting-in-splunk-making-the-siem-speak-first?utm_source=hashnode&utm_medium=feed) After enriching Apache logs with a threat intelligence lookup, the next obvious question was: Why should I keep checking this manually? In a SOC, if a known bad IP appears in live traffic, the system should tell you — not the other way around.This ... 2 min read · [abishekvengeri.hashnode.dev](https://abishekvengeri.hashnode.dev/threat-intelligence-alerting-in-splunk-making-the-siem-speak-first?utm_source=hashnode&utm_medium=feed) [Dec 21, 2025](https://hashnode.com/posts/threat-intelligence-alerting-in-splunk-making-the-siem-speak-first/69475cb9095f362f605c4f95) ### [Threat Intelligence Correlation in Splunk — Practical Guide](https://abishekvengeri.hashnode.dev/threat-intelligence-correlation-in-splunk-practical-guide?utm_source=hashnode&utm_medium=feed) I wanted to test how useful simple threat feeds are when combined with live web logs. The goal was straightforward: upload a small threat feed, enrich Apache logs with it, and see whether I can quickly highlight risky IPs on a dashboard. This lab is ... 3 min read · [abishekvengeri.hashnode.dev](https://abishekvengeri.hashnode.dev/threat-intelligence-correlation-in-splunk-practical-guide?utm_source=hashnode&utm_medium=feed) [Dec 20, 2025](https://hashnode.com/posts/threat-intelligence-correlation-in-splunk-practical-guide/69460b467c2914094b5c7c8a)