Back to selected work

Defensive security · Academic team project

OSIRISSentinel

An open-source SIEM/XDR laboratory built to centralize and investigate security events across Linux, Windows and network infrastructure.

Status
Completed project
WazuhProxmox VELinuxWindows 11DockerpfSenseSuricataSysmon

The completed project was designed as a small but realistic monitoring environment: several operating systems, network controls and security data sources feeding a central investigation platform.

Three-minute project demonstration

How it works

01

Laboratory environment

Proxmox VE hosted the virtual infrastructure. An Ubuntu Server ran Wazuh Manager, Indexer and Dashboard through Docker Compose, with monitored Linux and Windows systems behind a pfSense gateway.

  • Linux server: Wazuh Agent, Apache and SSH
  • Windows 11 workstation: Wazuh Agent, Sysmon and Windows Event Logs
  • pfSense: gateway, firewall, network isolation and syslog collection
  • Suricata: network intrusion detection
  • Kali Linux: controlled attack and validation machine
02

Detection and validation

The team did not stop at connecting data sources. Controlled activity from Kali and the monitored hosts was used to verify collection, detection and investigation paths.

  • SSH authentication and brute-force detection
  • File Integrity Monitoring
  • Apache access-log collection
  • Windows and Sysmon event collection
  • pfSense syslog and Suricata event collection
  • Controlled scans and attack scenarios
  • Correlation and dashboard work
03

Project outcome

The four-week team project concluded with a working laboratory, technical documentation, investigation dashboards and a final demonstration. The results described here are collective project outcomes.

Project media

Source code

Inspect the project on GitHub.

Open repository