From evidence to decision

Monitoring & Detection

Learn how defenders turn security evidence into decisions. Start with the concepts, investigate real traffic, or build a monitoring lab at your own pace.

Find my path Start the foundations

Evidenceready to investigate

3learning routes 8practical tools 1clear first step

01

Follow the evidence

Select each stage to see how an analyst moves from raw activity to a supported decision.

01CollectBring evidence together 02DetectFind activity worth checking 03InvestigateTest possible explanations 04DecideClose, continue, or escalate

Stage 1 Collect useful evidence

Gather logs, endpoint activity, network records, or packets that can answer a defined security question.

Ask: Is the source producing complete and reliable evidence?

02

Find your learning path

Choose what you want to achieve. The page will highlight the best place to begin.

I am new to monitoring I want to inspect traffic I want to build a lab

Best match Learn the foundations

Build the vocabulary needed for every practical guide without installing anything.

Recommended first Learn the foundations Understand SIEM, IDS, IPS, and network traffic analysis before choosing a platform. Level Beginner Setup None Time 60 to 90 min Outcome Explain how evidence becomes an alert and then an investigation. Fastest practical path Investigate network traffic Open a packet capture, apply filters, and follow a network conversation. Level Beginner to intermediate Setup One computer Time 45 to 90 min Outcome Identify and describe useful packet evidence. Build a monitoring lab Collect and correlate events Choose Splunk, Wazuh, or Security Onion based on the evidence and workflow you need. Level Intermediate Setup Multiple VMs Time 4 to 10+ hours Outcome Trace a controlled event from its source to an analyst decision.

03

Build your foundation

These short concept guides work without a lab. Complete them in order or open the topic you need.

1

Security monitoringUnderstanding SIEM

Collect, organise, correlate, and investigate events.

2

Network detectionUnderstanding IDS and IPS

Detect suspicious activity and understand safe prevention.

3

Network analysisUnderstanding NTA

Use packets, flows, and protocol metadata in an investigation.

04

Choose a tool by evidence

You do not need every platform. Select the evidence you want to examine and start with one focused tool.

LOGLogs and eventsBusiness, identity, and system activity ENDEndpoint activityProcesses, files, and response IDSNetwork alertsRules, signatures, and prevention PCAPPackets and metadataTraffic, protocols, and conversations

Best starting point for logs and events Splunk

Search and connect many kinds of machine data, then turn useful searches into reports, alerts, and dashboards.

Also consider Wazuh for endpoint led monitoring or Security Onion for network led investigation.

Explore Splunk

05

Check your lab readiness

Complete these checks before running a detection, prevention, or automated response exercise.

!

Preparation requiredComplete all five safety checks before starting.

I own the systems or have permission to monitor them. The virtual network is isolated where the exercise requires it. I recorded the product and operating system versions. The computer meets the hardware requirements. I have a rollback plan for blocking or automated response.