Christopher Stassinos
Labs / Private Project Brief
Detection Engineering · Home Lab

SIEMDetection Lab

A self-contained security operations lab on VMware, where a Windows Active Directory domain behind a pfSense firewall feeds host, identity, and network telemetry into Splunk. The workflow is straightforward: generate test activity, collect the right logs, and turn that data into working detections.

  • Windows Server runs Active Directory and Group Policy; domain-joined clients produce real authentication, account, and policy events.
  • Sysmon and Windows Event Forwarding ship endpoint and identity telemetry into a single Splunk index.
  • Brute force attempts, lockouts, and privilege escalation are simulated on purpose, then each one is detected with a focused Splunk search.
Back to portfolio Download CV
Architecture

How the lab is wired together

One VMware host, four roles. pfSense sits at the edge and segments the lab network. A Windows Server domain controller runs Active Directory and Group Policy while domain-joined clients generate real logon and account traffic. Sysmon and Windows Event Forwarding stream that activity into a single Splunk index — one pane of glass to search, correlate, and alert across the whole domain.

01 / Domain

Windows Server + Active Directory

A domain controller provides AD authentication, Group Policy, and OU structure, while domain-joined clients produce realistic logon, account, and policy-change events.

02 / Telemetry

Sysmon + Event Forwarding

Sysmon enriches endpoint visibility with process, network, and registry events, and Windows Event Forwarding centralizes host and identity logs for ingestion into Splunk.

03 / Analytics

Splunk index and search

All forwarded data lands in Splunk, where saved searches and dashboards turn raw Windows and Sysmon events into detections, timelines, and investigative views.

Detections

Attacks simulated, then caught

Same discipline every time: run the attack against the domain, confirm the events land in Splunk, then write a search that isolates that behavior and nothing else. Detection logic is pinned to specific Windows security event IDs — not keyword guesses.

splunk > search · detections.spl
Brute Force Logons EventCode 4625 High 
> EventCode=4625 | stats count by src_ip, user | where count > 15
Account Lockouts EventCode 4740 Medium 
> EventCode=4740 | stats count by user, ComputerName | sort - count
Privilege Escalation 4672 · 4728 · 4732 High 
> (EventCode=4672 OR EventCode=4728 OR EventCode=4732)
  | table _time, user, Group_Name
Suspicious Process Tree Sysmon EID 1 Medium 
> source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  | stats count by ParentImage, Image
Outcomes

What the lab demonstrates

Detection Engineering

From event to alert

  • Maps test activity to specific Windows security event IDs and Sysmon telemetry.
  • Produces validated Splunk searches that fire on the intended activity and stay quiet otherwise.
SOC Fundamentals

Centralized visibility

  • Consolidates host, identity, and network signals into one searchable Splunk index.
  • Builds the muscle memory of triage, correlation, and investigation across a domain.
Infrastructure

Realistic environment

  • Stands up AD, Group Policy, and a segmented network rather than a single test box.
  • Operates the lab like a small enterprise so detections reflect production-style data.