# angesh021/soc-homelab architecture

> Architecture diagram of the GitHub repository angesh021/soc-homelab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/angesh021/soc-homelab
- Repository: https://github.com/angesh021/soc-homelab

## Overview

1. **What this repo is**
   - This is a **blue-team lab architecture repository**, not an application codebase.
   - It defines how to stand up a small, isolated SOC environment and how to tune detections for repeatable attack simulations.

2. **Core architectural pattern**
   - The design is a **hub-and-spoke monitoring setup**:
     - a central **SOC VM** aggregates telemetry,
     - a **Windows victim endpoint** generates endpoint and Windows event data,
     - a **Kali attacker VM** generates adversary traffic and host activity.
   - The main boundary is between **monitoring infrastructure** and **simulated attack traffic**.

3. **Network segmentation**
   - The lab is split into two CIDR ranges:
     - **SOC_NET `10.10.10.0/24`** for monitoring and SIEM/NSM services,
     - **ATTACK_NET `10.20.20.0/24`** for red-team activity.
   - The Windows victim is dual-homed in both networks, which is important for diagramming because it is the bridge where most telemetry originates.

4. **Virtual machine roles**
   - **SOC VM (Ubuntu, `10.10.10.10`)**: runs the central detection stack.
   - **Windows 10 Victim (`10.10.10.20` / `10.20.20.20`)**: endpoint under test; hosts Sysmon and the Wazuh agent.
   - **Kali Attacker (`10.20.20.10`)**: sources reconnaissance, brute force, malware simulation, PowerShell abuse, and privilege-escalation exercises.

5. **Central monitoring stack**
   - The SOC VM contains the main analysis boundary:
     - **Wazuh Manager** for log collection, correlation, and alerting,
     - **Zeek** for network behavioral metadata,
     - **Suricata** for signature-based IDS/IPS alerts.
   - This makes Wazuh the central alerting/correlation layer, while Zeek and Suricata provide independent evidence streams.

6. **Endpoint telemetry path**
   - On the Windows host, **Sysmon** captures process creation, network connections, file activity, and related endpoint behavior.
   - The **Wazuh agent / Windows log forwarding** path sends Windows telemetry up to the SOC VM.
   - In the architecture diagram, Sysmon should sit on the victim host, feeding the SIEM, not directly interacting with Zeek/Suricata.

7. **Network telemetry path**
   - **Zeek** observes traffic patterns and produces connection-level and protocol metadata, useful for recon and web/powershell downloads.
   - **Suricata** inspects packets for known signatures such as scan, brute-force, and suspicious PowerShell-related patterns.
   - These tools are passive observers on the SOC side of the lab network and complement endpoint telemetry.

8. **Detection layer and correlation**
   - **Wazuh** is the detection engine that turns raw events into alerts.
   - The repo’s custom rules in `configs/wazuh/local_rules.xml` cover:
     - failed authentication,
     - brute-force correlation by source IP,
     - new user creation,
     - privileged group membership changes.
   - This is the repo’s main “engineering” boundary: raw telemetry enters, correlated security detections emerge.

9. **Configuration assets**
   - `configs/` is the main implementation directory and is organized by sensor:
     - `configs/wazuh/` — Wazuh manager rules/config,
     - `configs/sysmon/` — Sysmon configuration for endpoint telemetry,
     - `configs/zeek/` — Zeek node/network configuration,
     - `configs/suricata/` — Suricata runtime/signature configuration.
   - These files are the operational artifacts that define what each sensor collects and how detections behave.

10. **Scenario documents**
   - `scenarios/` contains six attack-playbook documents that validate the lab end to end:
     - port scan recon,
     - brute force,
     - EICAR malware simulation,
     - file integrity monitoring,
     - privilege escalation,
     - malicious PowerShell.
   - Each scenario ties attacker action to expected telemetry and the corresponding SOC-side detection, so they function as test cases for the architecture.

11. **Detection flow**
   - The effective data flow is:
     - **Kali attacker** generates traffic or host actions,
     - **Windows victim** records endpoint evidence via Sysmon/Windows events,
     - **Zeek/Suricata** observe the network,
     - **Wazuh agent/manager** ingests logs and applies correlation,
     - **alerts** are produced for analyst review.
   - This is the primary diagram to capture: one attack source, one monitored endpoint, three telemetry layers, one central SIEM.

12. **What to emphasize in an architecture diagram**
   - Show the **SOC VM as the aggregation and analysis center**.
   - Show the **Windows victim as the telemetry-rich endpoint**.
   - Show **Kali as the isolated adversary source** on a separate subnet.
   - Draw separate paths for **endpoint telemetry** and **network telemetry**, converging at Wazuh.

13. **Repository boundary**
   - There is no application runtime, database, or business logic here.
   - The repo’s purpose is to store **sensor configs, custom detections, and attack-validation scenarios** for a controlled SOC lab.

Main entry points: [`configs/wazuh/ossec.conf`](https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/ossec.conf) (Wazuh Manager), [`configs/wazuh/local_rules.xml`](https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/local_rules.xml) (Wazuh Rules), [`configs/zeek/nodes.cfg`](https://github.com/angesh021/soc-homelab/blob/main/configs/zeek/nodes.cfg) (Zeek), [`scenarios`](https://github.com/angesh021/soc-homelab/tree/main/scenarios) (Scenarios)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lab_hosts["Lab hosts"]
  node_soc_vm["SOC VM<br/>ubuntu control node"]
  node_windows_victim["Windows Victim<br/>dual-homed endpoint"]
  node_sysmon["Sysmon<br/>endpoint telemetry<br/>[sysmonconfig.xml]"]
  node_wazuh_agent["Wazuh Agent<br/>log forwarder<br/>[ossec.conf]"]
  node_kali_attacker["Kali Attacker<br/>adversary source"]
  node_soc_net(("SOC_NET<br/>10.10.10.0/24"))
  node_attack_net(("ATTACK_NET<br/>10.20.20.0/24"))
end

subgraph group_monitoring_stack["Monitoring stack"]
  node_wazuh_manager["Wazuh Manager<br/>siem correlation<br/>[ossec.conf]"]
  node_zeek["Zeek<br/>network metadata<br/>[nodes.cfg]"]
  node_suricata["Suricata<br/>ids sensor<br/>[suricata.yaml]"]
  node_alerts(("Alerts<br/>detection output"))
end

subgraph group_repo_assets["Repo assets"]
  node_wazuh_rules["Wazuh Rules<br/>local detections<br/>[local_rules.xml]"]
  node_scenario_suite["Scenarios<br/>attack playbooks"]
  node_port_scan["Port Scan<br/>recon scenario"]
  node_bruteforce["Brute Force<br/>auth scenario"]
  node_eicar["EICAR<br/>malware simulation"]
  node_fim["FIM<br/>file integrity"]
  node_privesc["Privilege Escalation<br/>escalation scenario"]
  node_powershell["Malicious PowerShell<br/>host abuse scenario"]
end

node_soc_vm -->|"hosts"| node_wazuh_manager
node_soc_vm -->|"hosts"| node_zeek
node_soc_vm -->|"hosts"| node_suricata
node_windows_victim -->|"collects"| node_sysmon
node_windows_victim -->|"forwards"| node_wazuh_agent
node_kali_attacker -->|"attacks"| node_windows_victim
node_kali_attacker -->|"resides in"| node_attack_net
node_windows_victim -->|"bridges"| node_soc_net
node_soc_vm -->|"resides in"| node_soc_net
node_wazuh_agent -->|"sends logs"| node_wazuh_manager
node_sysmon -->|"feeds"| node_wazuh_manager
node_zeek -->|"feeds"| node_wazuh_manager
node_suricata -->|"feeds"| node_wazuh_manager
node_wazuh_manager -->|"produces"| node_alerts
node_wazuh_rules -->|"configures"| node_wazuh_manager
node_scenario_suite -.->|"drives"| node_kali_attacker
node_scenario_suite -.->|"targets"| node_windows_victim
node_scenario_suite -.->|"verifies"| node_wazuh_manager
node_port_scan -.->|"tests"| node_zeek
node_port_scan -.->|"tests"| node_suricata
node_bruteforce -.->|"tests"| node_wazuh_rules
node_eicar -.->|"tests"| node_sysmon
node_fim -.->|"tests"| node_wazuh_rules
node_privesc -.->|"tests"| node_wazuh_rules
node_powershell -.->|"tests"| node_zeek
node_powershell -.->|"tests"| node_wazuh_rules

click node_wazuh_manager "https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/ossec.conf"
click node_zeek "https://github.com/angesh021/soc-homelab/blob/main/configs/zeek/nodes.cfg"
click node_suricata "https://github.com/angesh021/soc-homelab/blob/main/configs/suricata/suricata.yaml"
click node_sysmon "https://github.com/angesh021/soc-homelab/blob/main/configs/sysmon/sysmonconfig.xml"
click node_wazuh_agent "https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/ossec.conf"
click node_wazuh_rules "https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/local_rules.xml"
click node_scenario_suite "https://github.com/angesh021/soc-homelab/tree/main/scenarios"
click node_port_scan "https://github.com/angesh021/soc-homelab/blob/main/scenarios/01_port_scan_recon.md"
click node_bruteforce "https://github.com/angesh021/soc-homelab/blob/main/scenarios/02_bruteforce_wazuh_rule.md"
click node_eicar "https://github.com/angesh021/soc-homelab/blob/main/scenarios/03_eicar_malware_simulation.md"
click node_fim "https://github.com/angesh021/soc-homelab/blob/main/scenarios/04_fim_sensitive_folder.md"
click node_privesc "https://github.com/angesh021/soc-homelab/blob/main/scenarios/05_privilege_escalation_detection.md"
click node_powershell "https://github.com/angesh021/soc-homelab/blob/main/scenarios/06_malicious_powershell.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_soc_vm,node_windows_victim,node_sysmon,node_wazuh_agent,node_kali_attacker,node_soc_net,node_attack_net toneBlue
class node_wazuh_manager,node_zeek,node_suricata,node_alerts toneAmber
class node_wazuh_rules,node_scenario_suite,node_port_scan,node_bruteforce,node_eicar,node_fim,node_privesc,node_powershell toneMint
```

## Components

### Lab hosts

Virtual machines and network segments in the isolated SOC lab.

- **SOC VM**: ubuntu control node · Central Ubuntu VM hosting the monitoring stack on SOC_NET.
- **Windows Victim**: dual-homed endpoint · Windows 10 host that bridges SOC_NET and ATTACK_NET and generates endpoint telemetry.
- [Sysmon](https://github.com/angesh021/soc-homelab/blob/main/configs/sysmon/sysmonconfig.xml): endpoint telemetry · Captures process, network, file, and related Windows endpoint events. · `configs/sysmon/sysmonconfig.xml`
- [Wazuh Agent](https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/ossec.conf): log forwarder · Forwards Windows and endpoint logs to the central manager. · `configs/wazuh/ossec.conf`
- **Kali Attacker**: adversary source · Isolated red-team VM used for recon, brute force, malware simulation, and PowerShell abuse.
- **SOC_NET**: 10.10.10.0/24 · Monitoring subnet for the SOC VM and network sensors.
- **ATTACK_NET**: 10.20.20.0/24 · Adversary subnet for attack simulation traffic.

### Monitoring stack

Central SOC services that collect telemetry and generate detections.

- [Wazuh Manager](https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/ossec.conf): siem correlation · Central log ingestion, correlation, and alerting layer. · `configs/wazuh/ossec.conf`
- [Zeek](https://github.com/angesh021/soc-homelab/blob/main/configs/zeek/nodes.cfg): network metadata · Passive network sensor producing connection and protocol telemetry. · `configs/zeek/nodes.cfg`
- [Suricata](https://github.com/angesh021/soc-homelab/blob/main/configs/suricata/suricata.yaml): ids sensor · Signature-based network inspection and alerting. · `configs/suricata/suricata.yaml`
- **Alerts**: detection output · Correlated security alerts surfaced for analyst review.

### Repo assets

Configuration and validation artifacts stored in the repository.

- [Wazuh Rules](https://github.com/angesh021/soc-homelab/blob/main/configs/wazuh/local_rules.xml): local detections · Custom rules for failed auth, brute force, new users, and privileged group changes. · `configs/wazuh/local_rules.xml`
- [Scenarios](https://github.com/angesh021/soc-homelab/tree/main/scenarios): attack playbooks · Validation playbooks for recon, brute force, EICAR, FIM, privilege escalation, and malicious PowerShell. · `scenarios`
- [Port Scan](https://github.com/angesh021/soc-homelab/blob/main/scenarios/01_port_scan_recon.md): recon scenario · Validates network scan detection and telemetry flow. · `scenarios/01_port_scan_recon.md`
- [Brute Force](https://github.com/angesh021/soc-homelab/blob/main/scenarios/02_bruteforce_wazuh_rule.md): auth scenario · Exercises failed authentication and correlation by source IP. · `scenarios/02_bruteforce_wazuh_rule.md`
- [EICAR](https://github.com/angesh021/soc-homelab/blob/main/scenarios/03_eicar_malware_simulation.md): malware simulation · Tests malware-related alerting and endpoint visibility. · `scenarios/03_eicar_malware_simulation.md`
- [FIM](https://github.com/angesh021/soc-homelab/blob/main/scenarios/04_fim_sensitive_folder.md): file integrity · Exercises sensitive file change detection. · `scenarios/04_fim_sensitive_folder.md`
- [Privilege Escalation](https://github.com/angesh021/soc-homelab/blob/main/scenarios/05_privilege_escalation_detection.md): escalation scenario · Validates privileged account and group-change detections. · `scenarios/05_privilege_escalation_detection.md`
- [Malicious PowerShell](https://github.com/angesh021/soc-homelab/blob/main/scenarios/06_malicious_powershell.md): host abuse scenario · Tests script-based abuse detection across endpoint and network telemetry. · `scenarios/06_malicious_powershell.md`

## Connections

- SOC VM → Wazuh Manager: hosts · SOC VM provides the central SIEM/correlation service.
- SOC VM → Zeek: hosts · SOC VM runs the Zeek sensor.
- SOC VM → Suricata: hosts · SOC VM runs the Suricata sensor.
- Windows Victim → Sysmon: collects · Sysmon captures endpoint behavior on the victim host.
- Windows Victim → Wazuh Agent: forwards · Windows logs and agent telemetry are forwarded to Wazuh.
- Kali Attacker → Windows Victim: attacks · Kali generates recon, auth abuse, malware simulation, and PowerShell activity.
- Kali Attacker → ATTACK_NET: resides in · Attacker operates on the red-team subnet.
- Windows Victim → SOC_NET: bridges · Victim is dual-homed across both lab networks.
- SOC VM → SOC_NET: resides in · SOC VM is on the monitoring subnet.
- Wazuh Agent → Wazuh Manager: sends logs · Agent forwards endpoint and Windows telemetry to the manager.
- Sysmon → Wazuh Manager: feeds · Endpoint telemetry is ingested by Wazuh for correlation.
- Zeek → Wazuh Manager: feeds · Network metadata is delivered to the central manager.
- Suricata → Wazuh Manager: feeds · IDS alerts are delivered to the central manager.
- Wazuh Manager → Alerts: produces · Correlation and rules generate analyst-facing alerts.
- Wazuh Rules → Wazuh Manager: configures · Custom local rules define central detection logic.
- Scenarios → Kali Attacker: drives · Playbooks specify attacker actions for validation.
- Scenarios → Windows Victim: targets · Playbooks validate telemetry and detections on the victim.
- Scenarios → Wazuh Manager: verifies · Playbooks confirm expected SOC-side alerts.
- Port Scan → Zeek: tests · Port scan scenario validates recon visibility in network metadata.
- Port Scan → Suricata: tests · Port scan scenario validates IDS signature coverage.
- Brute Force → Wazuh Rules: tests · Brute-force scenario exercises failed auth correlation rules.
- EICAR → Sysmon: tests · EICAR scenario validates endpoint telemetry and alerting.
- FIM → Wazuh Rules: tests · FIM scenario exercises file integrity-related detections.
- Privilege Escalation → Wazuh Rules: tests · Privilege escalation scenario validates account and group-change rules.
- Malicious PowerShell → Zeek: tests · Malicious PowerShell scenario checks network and download metadata.
- Malicious PowerShell → Wazuh Rules: tests · Malicious PowerShell scenario validates custom detections.