Defensive security · Academic team project
OSIRISSentinel
An open-source SIEM/XDR laboratory built to centralize and investigate security events across Linux, Windows and network infrastructure.
- Status
- Completed project
- Source
- View repository
The completed project was designed as a small but realistic monitoring environment: several operating systems, network controls and security data sources feeding a central investigation platform.
How it works
Laboratory environment
Proxmox VE hosted the virtual infrastructure. An Ubuntu Server ran Wazuh Manager, Indexer and Dashboard through Docker Compose, with monitored Linux and Windows systems behind a pfSense gateway.
- Linux server: Wazuh Agent, Apache and SSH
- Windows 11 workstation: Wazuh Agent, Sysmon and Windows Event Logs
- pfSense: gateway, firewall, network isolation and syslog collection
- Suricata: network intrusion detection
- Kali Linux: controlled attack and validation machine
Detection and validation
The team did not stop at connecting data sources. Controlled activity from Kali and the monitored hosts was used to verify collection, detection and investigation paths.
- SSH authentication and brute-force detection
- File Integrity Monitoring
- Apache access-log collection
- Windows and Sysmon event collection
- pfSense syslog and Suricata event collection
- Controlled scans and attack scenarios
- Correlation and dashboard work
Project outcome
The four-week team project concluded with a working laboratory, technical documentation, investigation dashboards and a final demonstration. The results described here are collective project outcomes.
Project media
Source code