Lab 7.3 — Feed the SIEM

Lab Overview

The Scenario

Your threat intelligence team has published a new event in MISP titled "Operation Midnight Relay" containing 3 confirmed malicious indicators of compromise. The IOCs were sourced from a partner organization that was breached last week using the same threat actor infrastructure.

Your task: take each IOC from MISP, search Wazuh for any historical evidence that these indicators have appeared in your environment, and produce a structured IOC Presence Report documenting which IOCs were found, when they appeared, which hosts were affected, and what response actions are recommended.

You have 50 minutes.

Part 1: Extract IOCs from MISP

Step 1: Log into MISP

Open the MISP web interface from your lab dashboard. Sign in with the pre-configured credentials shown on the lab landing page.

Step 2: Locate the Threat Intel Event

Navigate to Events in the top menu. You should see the event titled "Operation Midnight Relay". Click on it to view the full event details.

Step 3: Review the Event Metadata

Before extracting IOCs, note the event context:

• Threat Level: High
• Analysis Status: Completed
• Distribution: Your organisation only
• Tags: Review any TLP and MITRE ATT&CK tags attached

Step 4: Extract the IOCs

The event contains 3 attributes (IOCs). For each one, record:

IOC EXTRACTION WORKSHEET
═══════════════════════════
Event: Operation Midnight Relay

IOC #1
  Type:     [ip-src / domain / md5 / sha256 / etc.]
  Value:    [the actual indicator]
  Category: [Network activity / Payload delivery / etc.]
  Comment:  [any analyst notes attached]

IOC #2
  Type:     [...]
  Value:    [...]
  Category: [...]
  Comment:  [...]

IOC #3
  Type:     [...]
  Value:    [...]
  Category: [...]
  Comment:  [...]

Click to enlarge

Part 2: Translate IOCs to Wazuh Queries

Understanding Field Mapping

Different IOC types map to different Wazuh fields:

Step 5: Build Your Queries

For each IOC you extracted, write the corresponding Wazuh query:

QUERY MAPPING
═════════════
IOC #1 → Wazuh Query: [field: value]
IOC #2 → Wazuh Query: [field: value]
IOC #3 → Wazuh Query: [field: value]

Part 3: Search Wazuh for Historical Hits

Step 6: Open Wazuh Dashboard

Switch to the Wazuh Dashboard. Navigate to Security Events (or Discover under the OpenSearch menu for raw log access).

Step 7: Set Your Time Range

Expand the time range to cover the full dataset. Click the date picker in the top-right and select Last 7 days or a custom range that covers the pre-loaded data window. If you see zero results, widen the window further.

Step 8: Search IOC #1

Paste your first query into the search bar. Document what you find:

IOC #1 SEARCH RESULTS
═════════════════════
Query Used:     [your query]
Total Hits:     [count]
Time of First Hit: [timestamp]
Time of Last Hit:  [timestamp]
Affected Host(s):  [agent name(s)]
Rule ID(s):        [Wazuh rules that fired]
Severity:          [rule levels]
Key Observation:   [what does this tell you?]

Step 9: Search IOC #2

Repeat for your second IOC. Pay attention to whether the results correlate with IOC #1 — same host? Same timeframe? Same attack chain?

Step 10: Search IOC #3

Repeat for your third IOC. By now you should be seeing a pattern across the three indicators.

Part 4: Build the IOC Presence Report

Step 11: Complete the Deliverable

Using your search results, fill in the IOC Presence Report table:

IOC PRESENCE REPORT
═══════════════════════════════════════════════════════════════════════════════════════
Intel Source: MISP — "Operation Midnight Relay"
Analyst:      [your name]
Date:         [today's date]
Environment:  CyberBlue Lab (Wazuh)

┌─────────────────────┬──────────┬────────────────┬─────────────────────┬──────────────────┬──────────────────────────┐
│ IOC                 │ Type     │ Found in Wazuh?│ Timestamp           │ Affected Host    │ Recommended Action       │
├─────────────────────┼──────────┼────────────────┼─────────────────────┼──────────────────┼──────────────────────────┤
│ [value]             │ [type]   │ Yes / No       │ [first seen]        │ [agent name]     │ [Block/Investigate/etc.] │
│ [value]             │ [type]   │ Yes / No       │ [first seen]        │ [agent name]     │ [Block/Investigate/etc.] │
│ [value]             │ [type]   │ Yes / No       │ [first seen]        │ [agent name]     │ [Block/Investigate/etc.] │
└─────────────────────┴──────────┴────────────────┴─────────────────────┴──────────────────┴──────────────────────────┘

SUMMARY
───────
Total IOCs Checked:  3
IOCs Found in Logs:  [count]
IOCs Not Found:      [count]
Hosts Affected:      [list]
Earliest Activity:   [timestamp]
Latest Activity:     [timestamp]
Correlation Notes:   [did multiple IOCs hit the same host/timeframe?]
Recommended Actions: [prioritized response steps]

Click to enlarge

Step 12: Determine Response Actions

For each IOC that had hits, determine the appropriate response:

Deliverable Checklist

Before completing the lab, ensure you have:

• IOC Extraction Worksheet — all 3 IOCs documented with type, value, and category from MISP
• Query Mapping — each IOC translated into a Wazuh-compatible search query
• Search Results — documented results for each IOC including hit counts, timestamps, and affected hosts
• IOC Presence Report — completed table with all 6 columns filled (IOC, Type, Found?, Timestamp, Host, Action)
• Summary Section — correlation notes and prioritized response actions
• Response Actions — justified recommendations for each IOC based on findings

What's Next

In Lab 7.4 — Tag the Threat, you'll take the IOCs you've confirmed as present and enrich them in MISP with sighting data, tags, and correlation links — turning raw indicators into actionable threat intelligence that can be shared with partner organizations.