How Tuning a SIEM From Scratch Exposes the Gaps in Default Security Rules

A cybersecurity practitioner documented their first hands-on project configuring and tuning a SIEM setup using Wazuh and Sysmon in a lab environment. The project focused on a three-node Active Directory setup to test how well default detection rules catch real adversary techniques such as credential dumping and log clearing. Out-of-the-box security tools were found to generate excessive alert noise while missing low-severity but high-risk indicators that blend into normal activity. The author had to write custom detection rules and modify existing policies to surface meaningful, actionable alerts from the log clutter. Key technical hurdles included silent agent disconnections caused by virtual machine idle suspensions, which required manual TCP connection checks and service restarts to resolve.