From Wazuh SIEM Lab to the Cloud: My Security Learning Path Toward AWS
How I built a 3-node Wazuh SIEM lab with FortiGate logs and n8n alert enrichment as an IT support engineer, and why I am now learning AWS cloud fundamentals.
Where I started
I work as an IT Support Engineer and recently passed CompTIA Security+. My goal is an entry-level SOC Analyst role, so I have been building small security labs to practice what I learn.
What I built
- A 3-node Wazuh SIEM environment for centralized log collection and monitoring
- FortiGate firewall syslog integration, which helped me spot brute-force patterns against SSL VPN in test traffic
- YARA and File Integrity Monitoring for malware and unauthorized-change detection
- Custom detection rules mapped to the MITRE ATT&CK framework
- An n8n workflow that enriches Wazuh alerts with AbuseIPDB threat intelligence, applies risk scoring, and sends notifications to analysts
What I learned
Good detection is not only about collecting logs. Alert triage, correlation and enrichment save an analyst a lot of time. Automating the repetitive steps leaves more time for real investigation.
Why AWS next
Most organizations now run workloads in the cloud, so SOC analysts need to understand cloud logging and the shared responsibility model. I am starting with AWS Cloud Practitioner and will share what I learn here.
Next steps
- Finish the Cloud Foundations learning path
- Explore AWS logging and monitoring services
- Try sending lab logs from AWS into my SIEM
If you work in cloud security or SOC, I would love to hear which AWS skills you think matter most for beginners.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article