3 Wazuh detections I wrote and tested in my home lab
Three detections from my home SOC lab, each written by hand for Wazuh, tested against a real attack, and checked for false positives. For every one I followed the same loop: trigger the attack → find
