What’s included
- Elastic Stack (Elasticsearch + Kibana) running in Docker
- Fleet Server configured and reachable
- Elastic Agent enrolled on Windows + Ubuntu
- Sysmon (Windows) integrated and shipping telemetry to Elastic
- Custom detection rule: Suspicious PowerShell – EncodedCommand
- Alert validation using Sysmon Event ID 1 (process creation)
Validation evidence
- Fleet shows both agents Healthy
- Sysmon logs visible in Discover (event.provider: Microsoft-Windows-Sysmon)
- Alert generated with process.command_line including -EncodedCommand
Why this matters
This lab demonstrates end-to-end SOC workflow: telemetry ingestion → detection engineering → alert validation → investigation via alert JSON fields.