Career Changer Documents First Wazuh SIEM Deployment and Endpoint Monitoring Tests

Michael Cooke, a marketing professional transitioning into cybersecurity, deployed a Wazuh SIEM environment in CloudShare to explore how Windows endpoint telemetry is captured from a defender's perspective. He tuned Sysmon configurations to improve logging quality for process creation, PowerShell activity, and file-related events. Cooke ran three experiments — file integrity monitoring, administrative command execution, and PowerShell activity — confirming that Wazuh successfully detected and ingested events from each. Along the way, he encountered configuration errors including an incorrect Windows Registry path and a misnamed Sysmon service, both of which he resolved through documentation review. He shared the project as his first contribution to the cybersecurity community, aimed at others beginning a blue team career path.