Detection Testing

Generating Safe Security Events

Generate safe Kubernetes and Windows host activity, search for it in Wazuh, and document what each endpoint can see.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

Detection Engineering SIEM Operations Incident Response

What this lesson covers

Generating safe Kubernetes lab events
Generating safe Windows host lab events
Confirming which endpoint produced the event
Using timestamps to find activity in Wazuh
Avoiding exploit, malware, credential, and evasion-style testing
Documenting event evidence for later investigation

Safety boundary: This lesson uses benign administrative and file activity only. The goal is SOC visibility, not attacker emulation.

Step 1: Confirm both monitored endpoints are active

In Wazuh, confirm that both endpoints are active before generating events.

Expected endpoints:
- Kubernetes node agent from the DaemonSet
- Windows host agent

From Kubernetes, confirm the DaemonSet agent is still running:

kubectl get pods -n wazuh-agents -o wide

On Windows, confirm the Wazuh service is running:

Get-Service WazuhSvc

Step 2: Set a test window

Before generating test activity, write down the current time. You will use this time window in Wazuh.

Get-Date

In the Wazuh dashboard, set the time range to the last 15 or 30 minutes so the lab events are easier to find.

Step 3: Generate a safe Kubernetes pod event

Run a short-lived pod that prints a clear lab message.

kubectl run soc-k8s-test -n wazuh-agents --image=busybox:latest --restart=Never -- sh -c "echo SOC Kubernetes visibility test $(date) && sleep 30"

kubectl logs -n wazuh-agents soc-k8s-test

kubectl delete pod -n wazuh-agents soc-k8s-test

What to look for

This event may appear directly or may help with correlation depending on what the Kubernetes agent is collecting. Use it to confirm timing, namespace, pod name, and endpoint context.

Step 4: Generate safe Windows file activity

Run these from PowerShell on the Windows host. This creates and removes a harmless temporary file.

$TestFile = "$env:TEMP\wazuh-windows-host-lab-test.txt"
New-Item -Path $TestFile -ItemType File -Force
Add-Content -Path $TestFile -Value "Wazuh Windows host lab test $(Get-Date)"
Get-Content -Path $TestFile
Remove-Item -Path $TestFile -Force

Step 5: Generate safe Windows inventory-style activity

These commands are normal administrative discovery commands. They are useful for visibility testing without crossing into offensive behavior.

whoami
hostname
ipconfig
Get-Process | Select-Object -First 5
Get-Service | Select-Object -First 5

Do not use: credential dumping, password extraction, exploit tools, malicious payloads, bypass techniques, persistence tests, or evasion-style commands in this beginner SOC lab.

Step 6: Search in Wazuh

In Wazuh, use the endpoint view and event/search views to look around the timestamp you recorded.

Search approach:
- Set time range to last 15 or 30 minutes
- Filter by endpoint: Windows host
- Filter by endpoint: Kubernetes node agent
- Compare timestamps
- Review rule description and severity
- Open full event details when available

Step 7: Capture evidence

Test name:
Endpoint:
Timestamp:
Command or action:
Expected result:
Observed Wazuh event:
Rule ID:
Severity:
Source:
Full log summary:
Screenshot captured:
Notes:

Step 8: Compare Kubernetes and Windows visibility

The goal is not for both endpoints to show the same data. The goal is to understand what each sensor can see.

Kubernetes agent sees:
- Node/container-oriented telemetry
- Kubernetes-adjacent activity depending on mounts and configuration
- Agent state for the Kubernetes node

Windows agent sees:
- Windows host inventory
- Windows endpoint events
- Windows security/configuration/compliance data depending on configuration

Bottom line: A SOC analyst must understand sensor coverage. No alert does not always mean no activity. It may mean the activity is outside the current collection scope.

Check your understanding

Why should you record the test time before generating events?
Why might a Kubernetes pod test not appear the same way as a Windows host test?
Why are benign file and inventory commands enough for this lab?
What should you document when an event appears?
What does it mean if expected activity does not appear?

Answer key

It gives you a narrow time window to search in Wazuh.
Different agents collect different telemetry from different operating environments.
The goal is visibility validation, not attack simulation.
Endpoint, timestamp, action, rule, severity, source, full log context, and notes.
It may mean collection does not cover that activity, the time range is wrong, the endpoint is disconnected, or the rule does not alert on it.