Case study · Oct 2026

Lookout: a home SOC lab, triaged for real.

I wanted to prove two things: that I can do real SOC work end to end, and that I can use AI inside a security workflow without letting it make the decisions. So I built the whole loop — attack, collect, detect, triage, write up — and published it.

Open the live demo Source on GitHub

RoleSolo — lab, detections, console, write-ups
StackWazuh 4.14.8 · Sysmon 15.22 · Atomic Red Team 2.3 · Next.js 16 · Postgres · Claude
StatusLive, public, read-only demo (sanitised lab data)

01 · The lab

Attacker, victim and SIEM — isolated.

Windows 11 ARM · victim

Endpoint

Atomic Red Team
Sysmon + sysmon-modular
Wazuh agent

events

Ubuntu 22.04 · SIEM

Wazuh 4.14.8

Manager · indexer · dashboard
Custom rules (local_rules.xml)
ATT&CK mapping

export · sanitise

Vercel · Postgres

Lookout console

Alert queue & cases
Coverage & detections
AI assist, human verdict

Host-only network: the victim is never exposed. Real hostnames, users and IPs are replaced with placeholders before anything leaves the lab.

02 · Findings

The defaults caught 4 of 8.

The most serious miss — LSASS credential dumping, the technique behind Mimikatz — wasn’t a rule problem first. Sysmon wasn’t collecting the access at all. I enabled ProcessAccess logging, then wrote the rule.

Eight ATT&CK techniques run against the lab, whether default Wazuh rules caught them, and the custom rule I wrote
Technique	What it is	Default Wazuh	My rule	What I found
`T1033`	System owner / user discoveryDiscovery	Missed	`100020`	whoami left no trace in the alert queue at all
`T1059.001`	Encoded PowerShellExecution	Caught	not needed	flagged by script-block logging, but only at level 4
`T1547.001`	Registry Run keyPersistence	Missed	`100030`	Sysmon logged it; no default rule raised it
`T1053.005`	Scheduled taskPersistence	Partial	`100050`	caught the dropped script, not the task itself
`T1136.001`	Create local accountPersistence	Caught	not needed	caught cleanly by the defaults
`T1003.001`	LSASS memory dumpCredential access	Missed	`100010`	the headline gap — a telemetry gap, not just a rule gap
`T1070.004`	File deletionDefense evasion	Caught	not needed	caught, at a low level worth raising
`T1560.001`	Archive for exfil (makecab)Collection	Missed	`100040`	a living-off-the-land tool nothing flagged

03 · Detections

Five rules, levels chosen on purpose.

Each rule is mapped to ATT&CK and has a severity that reflects how often the behaviour is legitimate.

Custom Wazuh rules
Rule	Level	ATT&CK	Detects	Notes
`100010`	12	`T1003.001`	Credential dumping — a process opened LSASS memory	Validated. Needed Sysmon ProcessAccess turned on first; now flags normal svchost.exe access too, which I document as a known false positive.
`100030`	10	`T1547.001`	Persistence — registry Run key value set	Promotes Sysmon event 13 on Run keys to an alert.
`100050`	8	`T1053.005`	Persistence — scheduled task created from the command line	Names the technique the defaults only caught indirectly.
`100040`	8	`T1560.001`	Collection — archiving tool launched	Watches living-off-the-land archivers such as makecab.exe.
`100020`	6	`T1033 · T1082 · T1016`	Discovery — recon binary executed	Low level on purpose: recon is common, so it adds context rather than noise.

Lookout alert detail with key fields, process tree, ATT&CK mapping and raw event

04 · The console

Every alert, the whole story.

Built for triage speed: keyboard triage (j/k/enter/t/f/e), filters in the URL, near-duplicate grouping, process trees, raw events and analyst notes.