# nnam099/enterprise-soc-detection-ir-lab architecture

> Architecture diagram of the GitHub repository nnam099/enterprise-soc-detection-ir-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-01). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nnam099/enterprise-soc-detection-ir-lab
- Repository: https://github.com/nnam099/enterprise-soc-detection-ir-lab

## Overview

This repository is a defensive SOC lab spanning Windows telemetry collection, Wazuh detections, threat-hunting evidence, and incident response. The main workflow follows endpoint activity into SIEM alerts, then analyst investigation and case timelines. It also documents lab topology, detection validation, and the distinction between independent validation events and confirmed incident evidence. The DFIR scripts show the evidence-to-timeline transformation; other subsystem links are included only where the README documents them, since most supporting files were not sampled.

Main entry points: [`dfir/timelines/DFIR-001-timeline.jsonl`](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/timelines/DFIR-001-timeline.jsonl) (Normalized Timeline), [`hunting/evidence`](https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/hunting/evidence) (Hunt Evidence), [`dfir/scripts/verify_case.py`](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/verify_case.py) (Case Verification), [`configs/wazuh/rules/local_rules.xml`](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/configs/wazuh/rules/local_rules.xml) (Custom Rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lab["Lab Environment"]
  node_endpoint["Windows Endpoint"]
  node_telemetry["Windows Logs"]
  node_agent["Wazuh Agent"]
  node_siem["Wazuh SIEM"]
  node_topology["Network Design<br/>[topology.md]"]
end

subgraph group_detect["Detection Engineering"]
  node_rules["Custom Rules<br/>[local_rules.xml]"]
  node_validation["Detection Validation"]
end

subgraph group_hunt["Threat Hunting"]
  node_huntplans["Hunt Analyses"]
  node_hunt_evidence["Hunt Evidence"]
end

subgraph group_response["Incident Response"]
  node_incident["SOC-INC-001 Investigation<br/>[README.md]"]
  node_incident_timeline["Incident Timeline<br/>[timeline.md]"]
end

subgraph group_dfir["DFIR Case Artifacts"]
  node_case_docs["DFIR-001 Case"]
  node_build["Timeline Builder<br/>[build_timeline.py]"]
  node_jsonl["Normalized Timeline"]
  node_export["Timeline Exporter<br/>[export_timeline.py]"]
  node_exports["CSV and Markdown"]
  node_verify["Case Verification<br/>[verify_case.py]"]
  node_schema["Timeline Schema"]
  node_hashes["Evidence Hashes<br/>[SHA256SUMS.txt]"]
end

node_activity(("Windows Activity"))

node_activity -->|"occurs on"| node_endpoint
node_endpoint -->|"generates"| node_telemetry
node_telemetry -->|"collected by"| node_agent
node_agent -->|"forwards logs"| node_siem
node_siem -->|"evaluates"| node_rules
node_rules -->|"validated by"| node_validation
node_huntplans -->|"documents evidence"| node_hunt_evidence
node_validation -.->|"produces evidence"| node_hunt_evidence
node_siem -->|"alerts inform"| node_incident
node_incident -->|"documents sequence"| node_incident_timeline
node_hunt_evidence -->|"reads records"| node_build
node_build -->|"writes timeline"| node_jsonl
node_jsonl -->|"reads timeline"| node_export
node_export -->|"writes formats"| node_exports
node_jsonl -->|"checks records"| node_verify
node_schema -->|"required input"| node_verify
node_hashes -->|"checks integrity"| node_verify

click node_topology "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/architecture/topology.md"
click node_rules "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/configs/wazuh/rules/local_rules.xml"
click node_validation "https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/screenshots/phase3-detection"
click node_huntplans "https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/hunting"
click node_hunt_evidence "https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/hunting/evidence"
click node_incident "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/incidents/SOC-INC-001/README.md"
click node_incident_timeline "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/incidents/SOC-INC-001/timeline.md"
click node_case_docs "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/cases/DFIR-001/investigation-report.md"
click node_build "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/build_timeline.py"
click node_jsonl "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/timelines/DFIR-001-timeline.jsonl"
click node_export "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/export_timeline.py"
click node_exports "https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/dfir/timelines"
click node_verify "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/verify_case.py"
click node_schema "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/schemas/timeline-schema.json"
click node_hashes "https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/evidence/DFIR-001/SHA256SUMS.txt"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_endpoint,node_telemetry,node_agent,node_siem,node_topology toneBlue
class node_rules,node_validation toneAmber
class node_huntplans,node_hunt_evidence toneMint
class node_incident,node_incident_timeline toneRose
class node_case_docs,node_build,node_jsonl,node_export,node_exports,node_verify,node_schema,node_hashes,node_activity toneIndigo
```

## Components

### Lab Environment

- **Windows Endpoint**
- **Windows Logs**
- **Wazuh Agent**
- **Wazuh SIEM**
- [Network Design](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/architecture/topology.md): `architecture/topology.md`

### Detection Engineering

- [Custom Rules](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/configs/wazuh/rules/local_rules.xml): `configs/wazuh/rules/local_rules.xml`
- [Detection Validation](https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/screenshots/phase3-detection): `screenshots/phase3-detection`

### Threat Hunting

- [Hunt Analyses](https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/hunting): `hunting`
- [Hunt Evidence](https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/hunting/evidence): `hunting/evidence`

### Incident Response

- [SOC-INC-001 Investigation](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/incidents/SOC-INC-001/README.md): `incidents/SOC-INC-001/README.md`
- [Incident Timeline](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/incidents/SOC-INC-001/timeline.md): `incidents/SOC-INC-001/timeline.md`

### DFIR Case Artifacts

- [DFIR-001 Case](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/cases/DFIR-001/investigation-report.md): `dfir/cases/DFIR-001/investigation-report.md`
- [Timeline Builder](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/build_timeline.py): `dfir/scripts/build_timeline.py`
- [Normalized Timeline](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/timelines/DFIR-001-timeline.jsonl): `dfir/timelines/DFIR-001-timeline.jsonl`
- [Timeline Exporter](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/export_timeline.py): `dfir/scripts/export_timeline.py`
- [CSV and Markdown](https://github.com/nnam099/enterprise-soc-detection-ir-lab/tree/main/dfir/timelines): `dfir/timelines`
- [Case Verification](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/scripts/verify_case.py): `dfir/scripts/verify_case.py`
- [Timeline Schema](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/schemas/timeline-schema.json): `dfir/schemas/timeline-schema.json`
- [Evidence Hashes](https://github.com/nnam099/enterprise-soc-detection-ir-lab/blob/main/dfir/evidence/DFIR-001/SHA256SUMS.txt): `dfir/evidence/DFIR-001/SHA256SUMS.txt`

### Other components

- **Windows Activity**

## Connections

- Windows Activity → Windows Endpoint: occurs on (evidence: `README.md`)
- Windows Endpoint → Windows Logs: generates (evidence: `README.md`)
- Windows Logs → Wazuh Agent: collected by (evidence: `README.md`)
- Wazuh Agent → Wazuh SIEM: forwards logs (evidence: `README.md`)
- Wazuh SIEM → Custom Rules: evaluates (evidence: `README.md`)
- Custom Rules → Detection Validation: validated by (evidence: `README.md`)
- Hunt Analyses → Hunt Evidence: documents evidence (evidence: `README.md`)
- Detection Validation → Hunt Evidence: produces evidence
- Wazuh SIEM → SOC-INC-001 Investigation: alerts inform (evidence: `README.md`)
- SOC-INC-001 Investigation → Incident Timeline: documents sequence (evidence: `README.md`)
- Hunt Evidence → Timeline Builder: reads records (evidence: `dfir/scripts/build_timeline.py`)
- Timeline Builder → Normalized Timeline: writes timeline (evidence: `dfir/scripts/build_timeline.py`)
- Normalized Timeline → Timeline Exporter: reads timeline (evidence: `dfir/scripts/export_timeline.py`)
- Timeline Exporter → CSV and Markdown: writes formats (evidence: `dfir/scripts/export_timeline.py`)
- Normalized Timeline → Case Verification: checks records (evidence: `dfir/scripts/verify_case.py`)
- Timeline Schema → Case Verification: required input (evidence: `dfir/scripts/verify_case.py`)
- Evidence Hashes → Case Verification: checks integrity (evidence: `dfir/scripts/verify_case.py`)