Investigating Alerts in Wazuh

Investigate Wazuh alerts using endpoint context, timestamps, rule details, full logs, and clear analyst notes.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

What this lesson covers

• Turning a Wazuh event into an analyst note
• Using endpoint, timestamp, rule, severity, and full log context
• Separating expected lab activity from unexpected activity
• Checking Kubernetes and Windows evidence together
• Writing a clear triage decision

Step 1: Pick one event to investigate

Choose one event from the safe test activity. Do not try to investigate everything at once.

Good first event choice:
- Recent timestamp
- Known endpoint
- Clear rule description
- Full log is available
- You know what action caused it

Step 2: Capture the core fields

Endpoint:
Endpoint ID:
Endpoint OS:
Timestamp:
Rule ID:
Rule description:
Severity:
MITRE tactic/technique if present:
Source location:
Full log summary:

Step 3: Validate the endpoint context

Confirm whether the alert came from the Kubernetes node agent or the Windows host agent.

Kubernetes context to check:
- Namespace
- Pod name
- Node name
- kubectl logs if relevant

Windows context to check:
- Hostname
- User context
- File path
- Process or service context
- Event timestamp

Step 4: Decide whether this is expected lab activity

Was this generated by the lab? yes/no
Was the endpoint expected? yes/no
Was the timestamp expected? yes/no
Was the action safe and documented? yes/no
Does severity match the behavior? yes/no
Does this need tuning? yes/no

Step 5: Write the analyst note

Analyst note template:
At [timestamp], Wazuh generated [rule ID / description] for [endpoint].
The event appears related to [known lab action / unknown activity].
Evidence reviewed: [full log, endpoint view, Kubernetes logs, Windows command output].
Assessment: [expected lab activity / suspicious / needs more review].
Recommended action: [document only / tune / investigate further / contain].

Step 6: Avoid common beginner mistakes

• Do not assume every alert is an incident.
• Do not assume no alert means no activity.
• Do not ignore endpoint context.
• Do not copy rule text without explaining what happened.
• Do not tune out alerts until you understand why they appeared.

Check your understanding

1. Why should you investigate one event at a time?
2. Why does endpoint context matter?
3. What is the difference between expected lab activity and a true incident?
4. What should be included in an analyst note?
5. Why should you avoid tuning too early?