Identity Threat Detection and Response Lab
Vault and Wazuh on one AWS host: five custom detection rules, 33 alerts mapped to MITRE ATT&CK.
A single t3.large on AWS, built with Terraform, runs HashiCorp Vault 1.15 and a single-node Wazuh 4.7.5 SIEM in Docker Compose. Vault's AWS secrets engine issues short-lived IAM users on request. Wazuh reads the host's auth log and, through an S3 bucket, AWS CloudTrail.
I wrote five custom Wazuh rules and ran three simulations on the host: an SSH username spray, a run of unauthorised sudo commands and Vault credential requests. They produced 33 alerts, mapped to MITRE ATT&CK: T1110 for password guessing and spraying, T1548.003 for sudo abuse, and T1078.004 and T1098 for IAM user creation. Separately I checked that a Vault-issued IAM user was deleted when its 900 second lease expired and when I revoked it.
This is a lab rather than a real attack: everything ran from localhost on one host, and CloudTrail takes 5 to 15 minutes to deliver events, so those alerts are not instant. I wrote the incident-response runbook but have not yet run it against the live alerts. Wazuh uses its default credentials and Vault's unseal key sits on the host, so a production setup would handle both differently.
Terraform, HashiCorp Vault, Wazuh, AWS CloudTrail, Docker Compose
