kexelex/soc-lab-simulation

How kexelex/soc-lab-simulation works

This repository documents a personal SOC lab for simulating attacks and investigating activity with Splunk. The principal workflow is to generate attack or endpoint activity in an isolated virtual environment, forward and ingest logs, then search and analyze them to create detections, dashboards, and alerts. The graph preserves the documented attack scenarios and governance mappings. Only README documentation was provided, so relationships are limited to those it explicitly describes; implementation details and topology beyond that documentation are not inferred.

Main entry points: README.md Splunk Enterprise · ssh-bruteforce-detection-lab/README.md SSH Brute Force · Phishing-Analysis-Lab/README.md Phishing Analysis

Components 17

Lab Environment

VirtualBox Lab README.md
Ubuntu Server README.md
Windows Endpoint README.md

SIEM Operations

Splunk Enterprise README.md
Universal Forwarder README.md
Linux Log Ingestion README.md
Searches and Alerts README.md
Dashboards README.md

Attack Scenarios

SSH Brute Force ssh-bruteforce-detection-lab/README.md
Phishing Analysis Phishing-Analysis-Lab/README.md
Reverse Shell README.md
Network Reconnaissance README.md
Privilege Escalation README.md

Analysis and Governance

MITRE ATT&CK Mapping README.md
ISO 27001 Alignment README.md

Other components

SOC Analyst
Kali Adversary

Connections 24

SOC Analyst → VirtualBox Lab: uses lab README.md
Kali Adversary → SSH Brute Force: simulates attack README.md
VirtualBox Lab → Ubuntu Server: hosts victim README.md
VirtualBox Lab → Windows Endpoint: hosts endpoint README.md
Universal Forwarder → Splunk Enterprise: forwards logs README.md
Windows Endpoint → Universal Forwarder: provides endpoint logs README.md
Ubuntu Server → Linux Log Ingestion: provides activity logs README.md
Linux Log Ingestion → Splunk Enterprise: ingests logs README.md
SOC Analyst → Splunk Enterprise: investigates events README.md
SOC Analyst → Searches and Alerts: creates detections README.md
SOC Analyst → Dashboards: creates dashboards README.md
Splunk Enterprise → Searches and Alerts: supports analysis README.md
Splunk Enterprise → Dashboards: visualizes events README.md
SSH Brute Force → Splunk Enterprise: monitored in README.md
SOC Analyst → Phishing Analysis: investigates indicators README.md
SOC Analyst → Reverse Shell: investigates activity README.md
SOC Analyst → Network Reconnaissance: investigates scans README.md
SOC Analyst → Privilege Escalation: analyzes activity README.md
SSH Brute Force → MITRE ATT&CK Mapping: maps technique README.md
Phishing Analysis → MITRE ATT&CK Mapping: maps technique README.md
Reverse Shell → MITRE ATT&CK Mapping: maps technique README.md
Network Reconnaissance → MITRE ATT&CK Mapping: maps technique README.md
Privilege Escalation → MITRE ATT&CK Mapping: maps technique README.md
SOC Analyst → ISO 27001 Alignment: aligns practices README.md

Drawn by GitDiagram on November 12, 2026 from the repository's file tree, README and source files. Read as Markdown ·