Wazuh SIEM & Telegram Alerting Lab

Problem / Objective

Build and document a complete monitoring workflow: identify an exposed Windows service, generate controlled authentication failures, collect the resulting event logs, investigate the activity in Wazuh, and verify a Telegram notification for a high-severity alert.

Environment

Ubuntu Server running the Wazuh manager
Windows 11 endpoint with the Wazuh agent and Remote Desktop enabled
Kali Linux used for controlled Nmap and Hydra testing
Telegram Bot API for alert notifications

What I did

Deployed and configured the Wazuh manager on Ubuntu Server and enrolled the Windows 11 endpoint as a monitored agent
Used Nmap from Kali Linux to identify the Remote Desktop service exposed on TCP port 3389
Generated repeated failed RDP authentication attempts with Hydra to create controlled Windows security events
Verified the ingestion of Windows Event Logs and investigated the related activity and alerts in Wazuh
Validated a Telegram notification for a Wazuh level-10 alert associated with multiple failed Windows logons
Documented the workflow from service discovery and event generation through SIEM investigation and notification

Tools used

WazuhUbuntu ServerWindows 11Kali LinuxNmapHydraWindows Event LogsRemote Desktop ProtocolTelegram Bot API

Key findings

The repeated failed RDP authentication attempts produced Windows security events that were ingested by Wazuh for investigation. The level-10 alert associated with multiple failures was then used to validate the Telegram notification workflow.

What I learned

How to trace controlled activity from service discovery and authentication events to SIEM ingestion, investigation, and notification
Why validating Windows Event Log ingestion is an essential step before troubleshooting downstream alerts
How to validate an external notification workflow against a known high-severity Wazuh alert
The value of documenting each stage so the monitoring workflow can be reproduced and reviewed