Virtual SOCWazuh + Active Directory

Built a VMware security lab around a Windows Server domain, monitored Windows and Linux guests, and a Wazuh SIEM. The focus is practical verification: prove identity works, trace fresh endpoint events into the SIEM, preserve evidence, and test recovery.

Configured Active Directory Domain Services and DNS, joined a Windows endpoint, and validated sign-in with a non-administrator domain account.
Confirmed fresh Sysmon and domain-controller telemetry reached Wazuh, including a repeat check after restoring the Windows endpoint.
Verified checkpoint recovery for Windows and a network-disconnected Kali test clone, plus a logical restore of 5,181 historical SIEM records.

Identity and endpoint monitoring

Active Directory foundation

Promoted a Windows Server domain controller with AD DS and DNS, checked domain health, and joined a Windows endpoint. Prepared organizational units, security groups, and staged role accounts.

Least-privilege sign-in

Verified an interactive domain logon with a non-administrator account. Checked the Windows logon event, Kerberos tickets, and SYSVOL access, then logged off the test user and disabled the temporary account.

Wazuh and Sysmon

Enrolled Windows and Linux guests in centralized monitoring. Generated tagged test activity and verified fresh domain-controller and Sysmon events in the Wazuh index, including Sysmon delivery after endpoint rollback.

Recovery tested against evidence

Windows checkpoint recovery

Exported test evidence, restored the domain-joined endpoint, and verified its machine identity and domain trust. Confirmed the temporary marker was absent and fresh Sysmon telemetry still reached Wazuh.

Isolated Kali reset

Created a network-disconnected linked clone for the reset test. Exported a benign marker, restored the clone's checkpoint, and verified isolation and marker removal after recovery.

SIEM index restoration

Restored 5,181 historical records into a temporary index and verified the full record count and saved archive hashes. Removed the temporary index after validation.

Domain-controller system-state backups were also created on a separate recovery disk, with backup catalogs and recovery items checked for readability.

Repeatable lab operations

PowerShell and Python scripts supported health checks, tagged event generation, evidence export, and acceptance reports. The project ties Windows identity administration to SIEM monitoring and recovery verification in a controlled virtual environment.

VMwareWazuhWindows ServerAD DS / DNSSysmonPowerShellPythonKali LinuxSnapshot recovery