Hey everyone,

I wanted to share my latest hands-on Blue Team lab project focused on centralized network security, IDS/IPS, and SIEM monitoring.

Lab Architecture & Tech Stack:

pfSense: Acts as the firewall and router, handling network segmentation.

Suricata: Configured for intrusion detection and prevention (IDS/IPS).

ELK Stack (Ubuntu Server): Collects, analyzes, and visualizes security logs via Kibana.

Environment: Virtualized using VMware with a dedicated victim (Windows) and attacker (Kali Linux) setup.

The project has significantly helped me understand network traffic monitoring and log analysis. You can check out the full technical documentation, architecture diagrams, and setup details on my GitHub:

🔗 GitHub Repository: https://github.com/umidguluzada/CyberDefense-Lab

I would love to hear your feedback, suggestions, or ideas for the next steps!

Hi everyone,

I'm just startin my cybersecurity journey and I'd really appreciate some guidance from people with more experience.

So far, I've learned some of the fundamentals: Linux and basic command-line usage, Networking fundamentals ,Basic reverse engineering ,x86 Assembly ,C ,Python.

I'm not sure what to focus on next. There are so many areas ( web security, binary exploitation, malware analysis, SOC, cloud security, etc.) it's a bit overwhelming.

I set up Wazuh in my virtual lab and played with its tools. I got to gain experience in file monitoring, vulnerability scanning, malware detection, active response and more. I wrote a Medium article which details the whole process.

https://medium.com/@ivandano77/deploying-wazuh-siem-xdr-in-virtual-lab-19644ca3cf51?sharedUserId=ivandano77