Built a complete enterprise-grade SOC environment from scratch: featuring Wazuh SIEM with custom detection rules, Security Onion with Suricata IDS/IPS and Zeek network monitoring, Active Directory with advanced security logging via Group Policy, and Windows Server with Sysmon telemetry. Designed and executed MITRE ATT&CK-aligned attack simulations from Kali Linux and validated detection coverage through red team exercises. Achieved over 95% detection rate across all tested techniques and tactics. This project served as the foundation for understanding how detection engineering decisions translate into real gaps and how to close them.