mordor VS loglizer

https://github.com/OTRF/Security-Datasets -> Any table in sentinel

Cloud resources (like Simuland: https://github.com/Azure/SimuLand ) might let you spin up your environment without at-home resources, but you can also learn about what attacks look like and how they work in defenses using something like the OTRF project: https://github.com/OTRF/Security-Datasets

To get started as easily as possible we’re looking to use data from the security datasets (formerly Mordor) project https://github.com/OTRF/Security-Datasets and converting some of this data to winlogbeat/ECS using this tool: https://github.com/barvhaim/mordor2ecs

Exactly! Either inline, or mirror your traffic via SPAN - assuming quite a lot of phones, tablets and other gear you‘ll definitely start spotting some not-so-hot traffic quite soon. In case you can arrange for a public IP at home, start tapping in and profile your visitors. In case you deem your homenet too boring - as mentioned - Mordor - hit your Onion with actual malicious traffic: https://github.com/OTRF/mordor

https://github.com/logpai/loglizer has an MIT license. Seems like they've done some of the heavy lifting already. If you're just looking for logs, check out https://github.com/logpai/loghub.

If you want to really get paranoid, then you can write a monitoring app that uses machine learning to do the log analysis and detect anomalies in your system. There are some open source tools available, like this for example. Also you can train the network for your specific use case and then just have the service running the inference on your logs and a pre-trainer model that is running on system logs. Then you really get in paranoid mode.