SOCDoneMay 2026SOCSIEMDetection EngineeringKQLSigma

$ F5 to Active Directory Attack Path SIEM

A local SIEM-style detection engineering lab for a simulated F5 BIG-IP to Linux, Confluence and Active Directory attack path, using synthetic telemetry, alert logic, investigation views and SIEM-ready rules.

# Overview

This project explores how a SOC could investigate a realistic edge-to-identity intrusion path without using exploit code or real credentials. The scenario follows an exposed F5 BIG-IP appliance, privileged SSH activity toward a Linux host, internal discovery, suspicious Confluence behavior and authentication activity that creates Active Directory risk. The lab generates synthetic telemetry for assets, trust relationships, Linux authentication, process execution, file access, network connections and Windows authentication. A local detection runner processes those events and produces alerts that follow the attack chain from initial exposure to identity risk. The SIEM interface turns the data into an investigation workspace: overview metrics, event search, alert triage, timeline reconstruction, detection library, case notes, risk mapping and report generation. It is designed to show both the analyst workflow and the reasoning behind each alert. Detection content is written in several practical formats: Python for the local rule engine, KQL for Microsoft Sentinel-style hunting, Sigma for portable detection logic and Splunk SPL for SIEM searches. The goal is to make the project useful for SOC analysis, detection engineering and risk communication at the same time.

# Metadata

Role

Detection engineer, SIEM designer and technical lab author

Stack / Themes

SOCSIEMDetection EngineeringKQLSigmaSplunkAttack PathF5 BIG-IPConfluenceActive Directory

# Outcomes

Built a local SIEM interface with overview, search, alerts, timeline, detections, cases, risk and reports.

Generated synthetic telemetry across Linux authentication, process creation, file access, network connections and Windows authentication.

Implemented six detection categories producing seven alert records across the attack chain.

Packaged detection logic as Python, KQL, Sigma and Splunk SPL for SOC engineering discussion.

# Images

Live SIEM overview dashboard showing telemetry counts, alert severity and attack path stages.

Architecture overview for the F5, Linux, Confluence and Active Directory detection lab.

Attack path stages from edge exposure to identity risk.

Alert dashboard preview for SOC triage and investigation.

Project deliverables covering telemetry, detections, SIEM views and reporting.

KQL detection snippet for privileged SSH from an F5 edge source.

Sigma rule snippet for suspicious Confluence Java child process behavior.

Python detection runner snippet correlating suspicious cross-system authentication.