Cybersecurity Beginner Builds Wazuh SIEM With Sysmon and Atomic Red Team Tests

Christopher Bontempi, a cybersecurity career-changer, documented his first hands-on SIEM project by deploying Wazuh and Sysmon on a Windows endpoint called ART Workstation. He used Atomic Red Team's safe attack simulations to generate controlled activity and verify whether the SIEM could detect it. Two of his three tests produced matching alerts in both Sysmon and Wazuh, confirming end-to-end log forwarding. A third test revealed a detection gap — Sysmon captured the activity locally, but no corresponding Wazuh alert was found — highlighting that logging tools must be actively validated, not assumed to be working. The project also surfaced practical lessons around using structured SIEM fields for searches and accounting for UTC timestamp differences between Sysmon and local system time.