# SIEM Hands-on Lab

> Deploy a practice SIEM environment, ingest raw log data, write complex correlation queries, and build actionable security dashboards from scratch.

Canonical: https://codelivly.com/rooms/siem-hands-on-lab
Last updated: 2026-07-07

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 200 |

Reading about SIEM architecture is one thing; staring down a massive spike in false positives and tuning the logic yourself is another. In this foundational hands-on module, we are moving out of the slides and into the console.

You will build a practice SIEM environment from the ground up. We will walk through the exact mechanics of ingesting raw, unstructured log data, normalizing it for analysis, and writing the complex correlation queries that actually catch threats. Finally, you will learn how to translate your query results into actionable, executive-ready security dashboards. Stop watching tutorials and start engineering your own detection environment.

## Lessons

1. Setting Up a Practice SIEM Environment (30 min)
2. Ingesting Sample Log Data (30 min)
3. Writing Search Queries Against Real Data (30 min)
4. Building a Basic Dashboard (30 min)
5. Writing a Sigma Rule from a Sysmon Event (30 min)

## Related

- [Learning path: SOC Tools: Hands-On Practicals](https://codelivly.com/learning-paths/soc-tools-hands-on-practicals)
- [All rooms](https://codelivly.com/rooms)