Triage a day of logs and write detections

#Brief

A security operations centre lives on logs. Build a realistic set (extend the generator from the SIEM shelf, or use a public sample), find the intrusion hidden in the noise, and turn your findings into tested, reusable detections.

#What to build

1. Produce a labelled log set that mixes normal activity, internet scanning and one multi-step intrusion (guessing, a success, privilege use, persistence)

2. Triage it: identify the incident, build a timeline, and write down what you dismissed as noise and why

3. Write Sigma rules for the key steps and one correlation (failures then success), each mapped to an ATT&CK technique

4. Build a test harness that runs the rules against known-bad and known-good logs and reports false positives and negatives

5. Write the analyst report: what happened, evidence, and recommended actions

#Deliverables

• Repository with logs/, rules/, tests/ and REPORT.md

#How it is graded

Reviewers run your test harness and add a new benign pattern to check your rules do not fire on it.

#Stretch

Load your rules and logs into a free SIEM (for example Elastic or Wazuh) and reproduce the alerts there.