# kexelex/soc-lab-simulation architecture

> Architecture diagram of the GitHub repository kexelex/soc-lab-simulation, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kexelex/soc-lab-simulation
- Repository: https://github.com/kexelex/soc-lab-simulation

## Overview

This repository documents a personal SOC lab for simulating attacks and investigating activity with Splunk. The principal workflow is to generate attack or endpoint activity in an isolated virtual environment, forward and ingest logs, then search and analyze them to create detections, dashboards, and alerts. The graph preserves the documented attack scenarios and governance mappings. Only README documentation was provided, so relationships are limited to those it explicitly describes; implementation details and topology beyond that documentation are not inferred.

Main entry points: [`README.md`](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md) (Splunk Enterprise), [`ssh-bruteforce-detection-lab/README.md`](https://github.com/kexelex/soc-lab-simulation/blob/Project/ssh-bruteforce-detection-lab/README.md) (SSH Brute Force), [`Phishing-Analysis-Lab/README.md`](https://github.com/kexelex/soc-lab-simulation/blob/Project/Phishing-Analysis-Lab/README.md) (Phishing Analysis)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lab["Lab Environment"]
  node_virtualbox["VirtualBox Lab<br/>[README.md]"]
  node_ubuntu_server["Ubuntu Server<br/>[README.md]"]
  node_windows_endpoint["Windows Endpoint<br/>[README.md]"]
end

subgraph group_siem["SIEM Operations"]
  node_splunk[("Splunk Enterprise<br/>[README.md]")]
  node_forwarder["Universal Forwarder<br/>[README.md]"]
  node_linux_ingestion["Linux Log Ingestion<br/>[README.md]"]
  node_detection["Searches and Alerts<br/>[README.md]"]
  node_dashboards["Dashboards<br/>[README.md]"]
end

subgraph group_scenarios["Attack Scenarios"]
  node_ssh_bruteforce["SSH Brute Force<br/>[README.md]"]
  node_phishing["Phishing Analysis<br/>[README.md]"]
  node_reverse_shell["Reverse Shell<br/>[README.md]"]
  node_recon["Network Reconnaissance<br/>[README.md]"]
  node_privilege_escalation["Privilege Escalation<br/>[README.md]"]
end

subgraph group_governance["Analysis and Governance"]
  node_mitre["MITRE ATT&amp;CK Mapping<br/>[README.md]"]
  node_iso["ISO 27001 Alignment<br/>[README.md]"]
end

node_analyst(("SOC Analyst"))
node_attacker(("Kali Adversary"))

node_analyst -->|"uses lab"| node_virtualbox
node_attacker -->|"simulates attack"| node_ssh_bruteforce
node_virtualbox -->|"hosts victim"| node_ubuntu_server
node_virtualbox -->|"hosts endpoint"| node_windows_endpoint
node_forwarder -->|"forwards logs"| node_splunk
node_windows_endpoint -->|"provides endpoint logs"| node_forwarder
node_ubuntu_server -->|"provides activity logs"| node_linux_ingestion
node_linux_ingestion -->|"ingests logs"| node_splunk
node_analyst -->|"investigates events"| node_splunk
node_analyst -->|"creates detections"| node_detection
node_analyst -->|"creates dashboards"| node_dashboards
node_splunk -->|"supports analysis"| node_detection
node_splunk -->|"visualizes events"| node_dashboards
node_ssh_bruteforce -->|"monitored in"| node_splunk
node_analyst -->|"investigates indicators"| node_phishing
node_analyst -->|"investigates activity"| node_reverse_shell
node_analyst -->|"investigates scans"| node_recon
node_analyst -->|"analyzes activity"| node_privilege_escalation
node_ssh_bruteforce -->|"maps technique"| node_mitre
node_phishing -->|"maps technique"| node_mitre
node_reverse_shell -->|"maps technique"| node_mitre
node_recon -->|"maps technique"| node_mitre
node_privilege_escalation -->|"maps technique"| node_mitre
node_analyst -->|"aligns practices"| node_iso

click node_virtualbox "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_ubuntu_server "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_windows_endpoint "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_splunk "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_forwarder "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_linux_ingestion "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_detection "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_dashboards "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_ssh_bruteforce "https://github.com/kexelex/soc-lab-simulation/blob/Project/ssh-bruteforce-detection-lab/README.md"
click node_phishing "https://github.com/kexelex/soc-lab-simulation/blob/Project/Phishing-Analysis-Lab/README.md"
click node_reverse_shell "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_recon "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_privilege_escalation "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_mitre "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"
click node_iso "https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_virtualbox,node_ubuntu_server,node_windows_endpoint toneBlue
class node_splunk,node_forwarder,node_linux_ingestion,node_detection,node_dashboards toneAmber
class node_ssh_bruteforce,node_phishing,node_reverse_shell,node_recon,node_privilege_escalation toneMint
class node_mitre,node_iso toneRose
class node_analyst,node_attacker toneIndigo
```

## Components

### Lab Environment

- [VirtualBox Lab](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Ubuntu Server](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Windows Endpoint](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`

### SIEM Operations

- [Splunk Enterprise](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Universal Forwarder](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Linux Log Ingestion](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Searches and Alerts](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Dashboards](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`

### Attack Scenarios

- [SSH Brute Force](https://github.com/kexelex/soc-lab-simulation/blob/Project/ssh-bruteforce-detection-lab/README.md): `ssh-bruteforce-detection-lab/README.md`
- [Phishing Analysis](https://github.com/kexelex/soc-lab-simulation/blob/Project/Phishing-Analysis-Lab/README.md): `Phishing-Analysis-Lab/README.md`
- [Reverse Shell](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Network Reconnaissance](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [Privilege Escalation](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`

### Analysis and Governance

- [MITRE ATT&CK Mapping](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`
- [ISO 27001 Alignment](https://github.com/kexelex/soc-lab-simulation/blob/Project/README.md): `README.md`

### Other components

- **SOC Analyst**
- **Kali Adversary**

## Connections

- SOC Analyst → VirtualBox Lab: uses lab (evidence: `README.md`)
- Kali Adversary → SSH Brute Force: simulates attack (evidence: `README.md`)
- VirtualBox Lab → Ubuntu Server: hosts victim (evidence: `README.md`)
- VirtualBox Lab → Windows Endpoint: hosts endpoint (evidence: `README.md`)
- Universal Forwarder → Splunk Enterprise: forwards logs (evidence: `README.md`)
- Windows Endpoint → Universal Forwarder: provides endpoint logs (evidence: `README.md`)
- Ubuntu Server → Linux Log Ingestion: provides activity logs (evidence: `README.md`)
- Linux Log Ingestion → Splunk Enterprise: ingests logs (evidence: `README.md`)
- SOC Analyst → Splunk Enterprise: investigates events (evidence: `README.md`)
- SOC Analyst → Searches and Alerts: creates detections (evidence: `README.md`)
- SOC Analyst → Dashboards: creates dashboards (evidence: `README.md`)
- Splunk Enterprise → Searches and Alerts: supports analysis (evidence: `README.md`)
- Splunk Enterprise → Dashboards: visualizes events (evidence: `README.md`)
- SSH Brute Force → Splunk Enterprise: monitored in (evidence: `README.md`)
- SOC Analyst → Phishing Analysis: investigates indicators (evidence: `README.md`)
- SOC Analyst → Reverse Shell: investigates activity (evidence: `README.md`)
- SOC Analyst → Network Reconnaissance: investigates scans (evidence: `README.md`)
- SOC Analyst → Privilege Escalation: analyzes activity (evidence: `README.md`)
- SSH Brute Force → MITRE ATT&CK Mapping: maps technique (evidence: `README.md`)
- Phishing Analysis → MITRE ATT&CK Mapping: maps technique (evidence: `README.md`)
- Reverse Shell → MITRE ATT&CK Mapping: maps technique (evidence: `README.md`)
- Network Reconnaissance → MITRE ATT&CK Mapping: maps technique (evidence: `README.md`)
- Privilege Escalation → MITRE ATT&CK Mapping: maps technique (evidence: `README.md`)
- SOC Analyst → ISO 27001 Alignment: aligns practices (evidence: `README.md`)