# nirmitrip/cybergenx-security-operations-lab architecture

> Architecture diagram of the GitHub repository nirmitrip/cybergenx-security-operations-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nirmitrip/cybergenx-security-operations-lab
- Repository: https://github.com/nirmitrip/cybergenx-security-operations-lab

## Overview

This repository documents and evidences a virtual security-operations lab, rather than implementing a software application. Its documented workflow runs from controlled reconnaissance and traffic generation through web defenses and intrusion detection to Wazuh monitoring and investigation. The README describes the system relationships; the tree contains configuration, demonstration scripts, and collected evidence, but no runtime source excerpts. Accordingly, service nodes represent the documented lab architecture, not code implemented here.

Main entry points: [`scripts/kali/cybergenx_demo.sh`](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/kali/cybergenx_demo.sh) (Kali Linux), [`configs/apache/demo.testfire.net.conf`](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/configs/apache/demo.testfire.net.conf) (Apache), [`evidence/wazuh`](https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/wazuh) (Wazuh Agent), [`evidence`](https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence) (Collected Evidence)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_offense["Offensive Validation"]
  node_kali["Kali Linux<br/>[cybergenx_demo.sh]"]
  node_recon["Reconnaissance"]
  node_webscan["Web Enumeration"]
  node_traffic["Test Traffic"]
end

subgraph group_web["Web Protection"]
  node_apache["Apache"]
  node_modsec["ModSecurity WAF<br/>[modsecurity.conf]"]
  node_crs["OWASP CRS"]
  node_apps["Vulnerable Apps"]
end

subgraph group_detection["Detection and SIEM"]
  node_snort["Snort IDS"]
  node_suricata["Suricata IDS"]
  node_agent["Wazuh Agent"]
  node_manager["Wazuh Manager"]
  node_indexer[("Wazuh Indexer")]
  node_dashboard["Wazuh Dashboard"]
  node_investigation["Threat Investigation"]
end

subgraph group_artifacts["Lab Artifacts"]
  node_ubuntu_demo["Ubuntu Demo"]
  node_wazuh_demo["Wazuh Demo<br/>[wazuh_demo_view.sh]"]
  node_evidence["Collected Evidence"]
end

node_operator(("Security Operator"))

node_operator -->|"runs"| node_kali
node_kali -->|"performs"| node_recon
node_kali -->|"enumerates"| node_webscan
node_kali -->|"generates"| node_traffic
node_traffic -->|"reaches"| node_apache
node_apache -->|"protected by"| node_modsec
node_modsec -->|"uses rules"| node_crs
node_apache -->|"serves"| node_apps
node_traffic -->|"detected by"| node_snort
node_traffic -->|"detected by"| node_suricata
node_snort -->|"monitored through"| node_agent
node_suricata -->|"monitored through"| node_agent
node_agent -->|"sends monitoring"| node_manager
node_manager -->|"indexes events"| node_indexer
node_indexer -->|"feeds"| node_dashboard
node_dashboard -->|"supports"| node_investigation
node_kali -.->|"collects"| node_evidence
node_ubuntu_demo -.->|"validates"| node_evidence
node_wazuh_demo -.->|"validates"| node_evidence

click node_kali "https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/kali/cybergenx_demo.sh"
click node_apache "https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/configs/apache/demo.testfire.net.conf"
click node_modsec "https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/configs/modsecurity/modsecurity.conf"
click node_snort "https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/snort"
click node_suricata "https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/suricata"
click node_agent "https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/wazuh"
click node_ubuntu_demo "https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/ubuntu/ubuntu_demo_view.sh"
click node_wazuh_demo "https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/wazuh/wazuh_demo_view.sh"
click node_evidence "https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_kali,node_recon,node_webscan,node_traffic toneBlue
class node_apache,node_modsec,node_crs,node_apps toneAmber
class node_snort,node_suricata,node_agent,node_manager,node_indexer,node_dashboard,node_investigation toneMint
class node_ubuntu_demo,node_wazuh_demo,node_evidence toneRose
class node_operator toneIndigo
```

## Components

### Offensive Validation

- [Kali Linux](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/kali/cybergenx_demo.sh): `scripts/kali/cybergenx_demo.sh`
- **Reconnaissance**
- **Web Enumeration**
- **Test Traffic**

### Web Protection

- [Apache](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/configs/apache/demo.testfire.net.conf): `configs/apache/demo.testfire.net.conf`
- [ModSecurity WAF](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/configs/modsecurity/modsecurity.conf): `configs/modsecurity/modsecurity.conf`
- **OWASP CRS**
- **Vulnerable Apps**

### Detection and SIEM

- [Snort IDS](https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/snort): `evidence/snort`
- [Suricata IDS](https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/suricata): `evidence/suricata`
- [Wazuh Agent](https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence/wazuh): `evidence/wazuh`
- **Wazuh Manager**
- **Wazuh Indexer**
- **Wazuh Dashboard**
- **Threat Investigation**

### Lab Artifacts

- [Ubuntu Demo](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/ubuntu/ubuntu_demo_view.sh): `scripts/ubuntu/ubuntu_demo_view.sh`
- [Wazuh Demo](https://github.com/nirmitrip/cybergenx-security-operations-lab/blob/main/scripts/wazuh/wazuh_demo_view.sh): `scripts/wazuh/wazuh_demo_view.sh`
- [Collected Evidence](https://github.com/nirmitrip/cybergenx-security-operations-lab/tree/main/evidence): `evidence`

### Other components

- **Security Operator**

## Connections

- Security Operator → Kali Linux: runs (evidence: `README.md`)
- Kali Linux → Reconnaissance: performs (evidence: `README.md`)
- Kali Linux → Web Enumeration: enumerates (evidence: `README.md`)
- Kali Linux → Test Traffic: generates (evidence: `README.md`)
- Test Traffic → Apache: reaches (evidence: `README.md`)
- Apache → ModSecurity WAF: protected by (evidence: `README.md`)
- ModSecurity WAF → OWASP CRS: uses rules (evidence: `README.md`)
- Apache → Vulnerable Apps: serves (evidence: `README.md`)
- Test Traffic → Snort IDS: detected by (evidence: `README.md`)
- Test Traffic → Suricata IDS: detected by (evidence: `README.md`)
- Snort IDS → Wazuh Agent: monitored through (evidence: `README.md`)
- Suricata IDS → Wazuh Agent: monitored through (evidence: `README.md`)
- Wazuh Agent → Wazuh Manager: sends monitoring (evidence: `README.md`)
- Wazuh Manager → Wazuh Indexer: indexes events (evidence: `README.md`)
- Wazuh Indexer → Wazuh Dashboard: feeds (evidence: `README.md`)
- Wazuh Dashboard → Threat Investigation: supports (evidence: `README.md`)
- Kali Linux → Collected Evidence: collects
- Ubuntu Demo → Collected Evidence: validates
- Wazuh Demo → Collected Evidence: validates