How angesh021/soc-homelab works
1. What this repo is
- This is a blue-team lab architecture repository, not an application codebase.
- It defines how to stand up a small, isolated SOC environment and how to tune detections for repeatable attack simulations.
2. Core architectural pattern
- The design is a hub-and-spoke monitoring setup:
- a central SOC VM aggregates telemetry,
- a Windows victim endpoint generates endpoint and Windows event data,
- a Kali attacker VM generates adversary traffic and host activity.
- The main boundary is between monitoring infrastructure and simulated attack traffic.
3. Network segmentation
- The lab is split into two CIDR ranges:
- SOC_NET 10.10.10.0/24 for monitoring and SIEM/NSM services,
- ATTACK_NET 10.20.20.0/24 for red-team activity.
- The Windows victim is dual-homed in both networks, which is important for diagramming because it is the bridge where most telemetry originates.
4. Virtual machine roles
- SOC VM (Ubuntu, 10.10.10.10): runs the central detection stack.
- Windows 10 Victim (10.10.10.20 / 10.20.20.20): endpoint under test; hosts Sysmon and the Wazuh agent.
- Kali Attacker (10.20.20.10): sources reconnaissance, brute force, malware simulation, PowerShell abuse, and privilege-escalation exercises.
5. Central monitoring stack
- The SOC VM contains the main analysis boundary:
- Wazuh Manager for log collection, correlation, and alerting,
- Zeek for network behavioral metadata,
- Suricata for signature-based IDS/IPS alerts.
- This makes Wazuh the central alerting/correlation layer, while Zeek and Suricata provide independent evidence streams.
6. Endpoint telemetry path
- On the Windows host, Sysmon captures process creation, network connections, file activity, and related endpoint behavior.
- The Wazuh agent / Windows log forwarding path sends Windows telemetry up to the SOC VM.
- In the architecture diagram, Sysmon should sit on the victim host, feeding the SIEM, not directly interacting with Zeek/Suricata.
7. Network telemetry path
- Zeek observes traffic patterns and produces connection-level and protocol metadata, useful for recon and web/powershell downloads.
- Suricata inspects packets for known signatures such as scan, brute-force, and suspicious PowerShell-related patterns.
- These tools are passive observers on the SOC side of the lab network and complement endpoint telemetry.
8. Detection layer and correlation
- Wazuh is the detection engine that turns raw events into alerts.
- The repo’s custom rules in configs/wazuh/local_rules.xml cover:
- failed authentication,
- brute-force correlation by source IP,
- new user creation,
- privileged group membership changes.
- This is the repo’s main “engineering” boundary: raw telemetry enters, correlated security detections emerge.
9. Configuration assets
- configs/ is the main implementation directory and is organized by sensor:
- configs/wazuh/ — Wazuh manager rules/config,
- configs/sysmon/ — Sysmon configuration for endpoint telemetry,
- configs/zeek/ — Zeek node/network configuration,
- configs/suricata/ — Suricata runtime/signature configuration.
- These files are the operational artifacts that define what each sensor collects and how detections behave.
10. Scenario documents
- scenarios/ contains six attack-playbook documents that validate the lab end to end:
- port scan recon,
- brute force,
- EICAR malware simulation,
- file integrity monitoring,
- privilege escalation,
- malicious PowerShell.
- Each scenario ties attacker action to expected telemetry and the corresponding SOC-side detection, so they function as test cases for the architecture.
11. Detection flow
- The effective data flow is:
- Kali attacker generates traffic or host actions,
- Windows victim records endpoint evidence via Sysmon/Windows events,
- Zeek/Suricata observe the network,
- Wazuh agent/manager ingests logs and applies correlation,
- alerts are produced for analyst review.
- This is the primary diagram to capture: one attack source, one monitored endpoint, three telemetry layers, one central SIEM.
12. What to emphasize in an architecture diagram
- Show the SOC VM as the aggregation and analysis center.
- Show the Windows victim as the telemetry-rich endpoint.
- Show Kali as the isolated adversary source on a separate subnet.
- Draw separate paths for endpoint telemetry and network telemetry, converging at Wazuh.
13. Repository boundary
- There is no application runtime, database, or business logic here.
- The repo’s purpose is to store sensor configs, custom detections, and attack-validation scenarios for a controlled SOC lab.
Main entry points: ossec.conf Wazuh Manager · local_rules.xml Wazuh Rules · nodes.cfg Zeek · scenarios Scenarios
Components 19
Lab hosts
Virtual machines and network segments in the isolated SOC lab.
- SOC VM · Central Ubuntu VM hosting the monitoring stack on SOC_NET.
- Windows Victim · Windows 10 host that bridges SOC_NET and ATTACK_NET and generates endpoint telemetry.
- Sysmon · Captures process, network, file, and related Windows endpoint events.
configs/sysmon/sysmonconfig.xml - Wazuh Agent · Forwards Windows and endpoint logs to the central manager.
configs/wazuh/ossec.conf - Kali Attacker · Isolated red-team VM used for recon, brute force, malware simulation, and PowerShell abuse.
- SOC_NET · Monitoring subnet for the SOC VM and network sensors.
- ATTACK_NET · Adversary subnet for attack simulation traffic.
Monitoring stack
Central SOC services that collect telemetry and generate detections.
- Wazuh Manager · Central log ingestion, correlation, and alerting layer.
configs/wazuh/ossec.conf - Zeek · Passive network sensor producing connection and protocol telemetry.
configs/zeek/nodes.cfg - Suricata · Signature-based network inspection and alerting.
configs/suricata/suricata.yaml - Alerts · Correlated security alerts surfaced for analyst review.
Repo assets
Configuration and validation artifacts stored in the repository.
- Wazuh Rules · Custom rules for failed auth, brute force, new users, and privileged group changes.
configs/wazuh/local_rules.xml - Scenarios · Validation playbooks for recon, brute force, EICAR, FIM, privilege escalation, and malicious PowerShell.
scenarios - Port Scan · Validates network scan detection and telemetry flow.
scenarios/01_port_scan_recon.md - Brute Force · Exercises failed authentication and correlation by source IP.
scenarios/02_bruteforce_wazuh_rule.md - EICAR · Tests malware-related alerting and endpoint visibility.
scenarios/03_eicar_malware_simulation.md - FIM · Exercises sensitive file change detection.
scenarios/04_fim_sensitive_folder.md - Privilege Escalation · Validates privileged account and group-change detections.
scenarios/05_privilege_escalation_detection.md - Malicious PowerShell · Tests script-based abuse detection across endpoint and network telemetry.
scenarios/06_malicious_powershell.md
Connections 26
- SOC VM → Wazuh Manager: hosts · SOC VM provides the central SIEM/correlation service.
- SOC VM → Zeek: hosts · SOC VM runs the Zeek sensor.
- SOC VM → Suricata: hosts · SOC VM runs the Suricata sensor.
- Windows Victim → Sysmon: collects · Sysmon captures endpoint behavior on the victim host.
- Windows Victim → Wazuh Agent: forwards · Windows logs and agent telemetry are forwarded to Wazuh.
- Kali Attacker → Windows Victim: attacks · Kali generates recon, auth abuse, malware simulation, and PowerShell activity.
- Kali Attacker → ATTACK_NET: resides in · Attacker operates on the red-team subnet.
- Windows Victim → SOC_NET: bridges · Victim is dual-homed across both lab networks.
- SOC VM → SOC_NET: resides in · SOC VM is on the monitoring subnet.
- Wazuh Agent → Wazuh Manager: sends logs · Agent forwards endpoint and Windows telemetry to the manager.
- Sysmon → Wazuh Manager: feeds · Endpoint telemetry is ingested by Wazuh for correlation.
- Zeek → Wazuh Manager: feeds · Network metadata is delivered to the central manager.
- Suricata → Wazuh Manager: feeds · IDS alerts are delivered to the central manager.
- Wazuh Manager → Alerts: produces · Correlation and rules generate analyst-facing alerts.
- Wazuh Rules → Wazuh Manager: configures · Custom local rules define central detection logic.
- Scenarios → Kali Attacker: drives · Playbooks specify attacker actions for validation.
- Scenarios → Windows Victim: targets · Playbooks validate telemetry and detections on the victim.
- Scenarios → Wazuh Manager: verifies · Playbooks confirm expected SOC-side alerts.
- Port Scan → Zeek: tests · Port scan scenario validates recon visibility in network metadata.
- Port Scan → Suricata: tests · Port scan scenario validates IDS signature coverage.
- Brute Force → Wazuh Rules: tests · Brute-force scenario exercises failed auth correlation rules.
- EICAR → Sysmon: tests · EICAR scenario validates endpoint telemetry and alerting.
- FIM → Wazuh Rules: tests · FIM scenario exercises file integrity-related detections.
- Privilege Escalation → Wazuh Rules: tests · Privilege escalation scenario validates account and group-change rules.
- Malicious PowerShell → Zeek: tests · Malicious PowerShell scenario checks network and download metadata.
- Malicious PowerShell → Wazuh Rules: tests · Malicious PowerShell scenario validates custom detections.