Full-stack enterprise security lab - firewall segmentation, SIEM/EDR, AD, and attack simulation on a single host.

Step-by-step setup of an ELK Stack (Elasticsearch, Kibana, Fluent Bit, Winlogbeat) for log ingestion, visualization, and threat detection. Includes installation on Ubuntu & Windows, data integration, and detection rules to simulate suspicious activity.

Practical guide to ElasticSearch & Kibana covering CRUD operations, ingestion pipelines, and custom threat detection rules for suspicious PowerShell activity on Windows. Includes tested scenarios with log shipping using Winlogbeat.

A unified intelligent SOC ecosystem where SIEM, SOAR, OpenXDR, Threat Intelligence, and AI/ML/LLM platforms are integrated into a cohesive operational pipeline. The system enables end-to-end security event processing: from log collection and normalization to analysis and automated incident response.