Wazuh × Shuffle
Detection engineering lab
3 write-ups from the lab, across 2 projects. Search them, or narrow down by project.
all-writeups
haadi@portfolio:~$ ls -1 *.md
3/3
3 lab write-ups
- 2026.07.22Security researchDetection engineering
Detecting Linux privilege escalation with custom Wazuh rules
Three rules for sudo abuse the default ruleset doesn't cover, how each was tuned against false positives, tested against a real simulated attack, and mapped to ATT&CK.
Wazuh · MITRE ATT&CK
- 2026.07.22Security researchDetection engineering
Wazuh → Shuffle SOAR Automation
A Shuffle workflow that receives Wazuh alerts over a webhook, filters them by severity, and automatically sends an email notification for anything serious enough to warrant one: instead of relying on someone watching the Wazuh dashboard.
Wazuh · Shuffle SOAR
- 2026.07.20Security researchDetection engineering
Automating Wazuh Alert Notifications Using Shuffle SOAR
A hands-on SIEM and SOAR integration lab: Wazuh detects a real SSH attack, forwards the alert to Shuffle, and an automated email notification fires within seconds: no manual dashboard monitoring required.
Wazuh · Shuffle SOAR