Cybersecurity project by Ryan Mendenhall
Wazuh SIEM Endpoints
Alternate between each endpoint via the dropdown menu in the top left of the dashboard. Interact with any section below to see the SIEM in greater detail.
| Execution | 3 |
| Impact | 2 |
| Defense Evasion | 1 |
| Microsoft Windows 11 Pro 10.0.26200.8037 | 1,480 |
| Google Chrome | 568 |
| Microsoft Edge | 13 |
| Microsoft Edge WebView2 Runtime | 13 |
| Policy Name | Passed | Failed | Score |
|---|---|---|---|
| CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 | 125 | 348 | 26% |
SOC Live Dashboard
This live dashboard provides a real-time window into the automated telemetry captured across your virtualized cybersecurity infrastructure. It aggregates threat intelligence from active Wazuh SIEM endpoints—tracking total event volume, classifying alerts by risk severity level, and mapping incoming security events directly to the MITRE ATT&CK framework. Designed to showcase automated endpoint protection and continuous threat monitoring, the feed highlights active attack vectors and system telemetry in real time.
Interactive Sandbox
Simulate a Level 12 Command & Control alert to see how the front-end SOC dashboard updates telemetry in real-time.
SOC Live Dashboard
This live dashboard provides a real-time window into the automated telemetry captured across your virtualized cybersecurity infrastructure. It aggregates threat intelligence from active Wazuh SIEM endpoints—tracking total event volume, classifying alerts by risk severity level, and mapping incoming security events directly to the MITRE ATT&CK framework. Designed to showcase automated endpoint protection and continuous threat monitoring, the feed highlights active attack vectors and system telemetry in real time.
Interactive Sandbox
Simulate a Level 12 Command & Control alert to see how the front-end SOC dashboard updates telemetry in real-time.
Ascendant.design is a completely virtual Security Operations Center (SOC) home lab designed to replicate authentic cyber attack and defense environments. Hosted on VirtualBox, the setup encompasses four virtual machines connected via a segregated internal network. The architecture includes a Windows 11 Pro workstation, a Kali Linux system for offensive operations, a Metasploitable target machine, and a Wazuh SIEM server. Every simulated attack is aligned with the MITRE ATT&CK framework and actively monitored for detection through Wazuh.
- Define Project Goal
- Install VirtualBox
- Create virtual machine environment
- Setup Wazuh Dashboard
- Assign Wazuh Agent
- Create VM Host-based Network
- Upload Screenshot of VirtualBox VM Setup
- Upload Screenshots of VMs
- Upload Screenshot of Wazuh Manager
- Create lab architecture diagram
- Implement More User Interaction Features
The following is an overview of the current virtual machine setup of the SOC Homelab:
Here are some interesting highlights from the monitoring of our virtual machine environments and the SIEM itself. Stay tuned for more information coming soon!