Building security visibility across a manufacturing estate

The challenge

A major industrial manufacturer needed consistent security monitoring across a distributed IT environment. Windows and Linux systems, identity services, endpoint protection, email and network equipment required different collection methods.

As Security Architect, I designed the Wazuh security information and event management (SIEM) solution and infrastructure roadmap.

What I did

• Established the platform and rollout pattern. The central Wazuh platform and initial collector were installed, with further locations on a phased roadmap. A repeatable K3s collector design and deployment guidance covered access, storage, capacity, recovery and platform health.
• Connected the event sources. I developed auditing guidance for Active Directory, DNS and DHCP using Windows Event Log and Sysmon. Kaspersky Security Center integration brought endpoint events through Syslog; the wider design mapped other source systems into the collection model.
• Defined detection and operating practices. Filtering, decoding, aggregation and correlation guidance connected source events to alerts. The roadmap included a planned backlog of 30 correlation rules, linked to MITRE ATT&CK scenarios. Wazuh Ruleset Test supported validation before relying on a rule.

Operating guidance addressed agents, roles, collectors and notifications, including how to distinguish a quiet environment from missing telemetry.

The outcome

The engagement delivered a central SIEM foundation, reproducible deployment guidance, integration designs and an operating model for the security team. Further source onboarding and detection development had an explicit plan.

The value was a monitoring service the team could maintain and extend, with clear steps from event collection to investigation. The scope was enterprise IT monitoring. Related approach: validating the complete detection path.