Speaker: Calvin Wilhelm-Hilgenstock

Using concrete real-world examples, we’ll demonstrate how to build an open-source SOC using Wazuh and DFIR-IRIS, and provide insight into architecture, event collection, alerting, and incident response. We’ll show how Windows, Linux, and network environments can be centrally monitored and security incidents detected.

Using concrete examples, we’ll also introduce custom rules, decoders, and the processing of security events. Finally, we’ll examine the key challenges of production operation, particularly scaling, storage, and high availability. The focus here is on technical implementation.

Afterward, there will be an opportunity for a Q&A session and a hands-on look at the environment at our booth: Hal ...