shakthivelb/splunk-soc-home-lab

How shakthivelb/splunk-soc-home-lab works

This repository describes a Splunk SOC lab for detecting SSH brute-force attempts and responding by blocking a source IP. The documented workflow runs an attack against a Linux target, forwards authentication logs to Splunk, searches for repeated failures, and presents results in dashboards; an identified IP can then be blocked with UFW. Configuration and scripts represent lab components, but no source excerpts were provided, so edges are limited to relationships stated in the README.

Main entry points: start_forwarder.sh Universal Forwarder · start_splunk.sh Splunk SIEM · run_hydra_attack.sh Hydra attack · ssh_config.txt SSH target

Components 14

Attack simulation

Hydra attack scripts/run_hydra_attack.sh

Target and collection

SSH target configuration/ssh_config.txt
Authentication logs logs
Log inputs configuration/inputs.conf
Universal Forwarder scripts/start_forwarder.sh
Forwarder outputs configuration/outputs.conf

SIEM analysis

Splunk SIEM scripts/start_splunk.sh
Brute-force detection detection/brute_force_detection.spl
Dashboard queries detection/dashboard_queries.spl
SOC dashboard detection

Incident response

IP block action scripts/block_ip_ufw.sh
UFW firewall

Other components

Kali attacker
SOC analyst

Connections 13

Kali attacker → Hydra attack: runs attack README.md
Hydra attack → SSH target: attempts SSH README.md
SSH target → Authentication logs: records failures README.md
Authentication logs → Universal Forwarder: forwards logs README.md
Log inputs → Universal Forwarder: configures inputs
Universal Forwarder → Forwarder outputs: uses outputs
Universal Forwarder → Splunk SIEM: sends logs README.md
Splunk SIEM → Brute-force detection: searches events README.md
Splunk SIEM → Dashboard queries: analyzes events README.md
Dashboard queries → SOC dashboard: visualizes results README.md
SOC analyst → SOC dashboard: reviews results
SOC analyst → IP block action: initiates response README.md
IP block action → UFW firewall: blocks source IP README.md

Drawn by GitDiagram on November 13, 2026 from the repository's file tree, README and source files. Read as Markdown ·