The completed lab successfully centralised system authentication logs using rsyslog, enabling real time analysis within Graylog. Detection rules and streams were effectively configured to identify specific security events, including multiple failed SSH login attempts, successful logins after repeated failures, and unusual sudo privilege escalation activity. Email notifications were configured via SMTP and triggered correctly when these security events occurred, ensuring timely alerting. In addition, a dashboard was built to visualise authentication activity in real time, providing clear visibility into system events. Overall, the lab delivered a fully functional SIEM setup that supports log ingestion, event correlation, alerting, and visual monitoring, closely reflecting workflows used in a Security Operations Centre.

Project Repository: https://github.com/Enowon/soc-graylog-soc-lab.git