# shakthivelb/splunk-soc-home-lab architecture

> Architecture diagram of the GitHub repository shakthivelb/splunk-soc-home-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/shakthivelb/splunk-soc-home-lab
- Repository: https://github.com/shakthivelb/splunk-soc-home-lab

## Overview

This repository describes a Splunk SOC lab for detecting SSH brute-force attempts and responding by blocking a source IP. The documented workflow runs an attack against a Linux target, forwards authentication logs to Splunk, searches for repeated failures, and presents results in dashboards; an identified IP can then be blocked with UFW. Configuration and scripts represent lab components, but no source excerpts were provided, so edges are limited to relationships stated in the README.

Main entry points: [`scripts/start_forwarder.sh`](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/start_forwarder.sh) (Universal Forwarder), [`scripts/start_splunk.sh`](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/start_splunk.sh) (Splunk SIEM), [`scripts/run_hydra_attack.sh`](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/run_hydra_attack.sh) (Hydra attack), [`configuration/ssh_config.txt`](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/ssh_config.txt) (SSH target)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_attack["Attack simulation"]
  node_hydra["Hydra attack"]
end

subgraph group_collection["Target and collection"]
  node_ssh["SSH target<br/>[ssh_config.txt]"]
  node_authlogs["Authentication logs"]
  node_inputs["Log inputs<br/>[inputs.conf]"]
  node_forwarder["Universal Forwarder<br/>[start_forwarder.sh]"]
  node_outputs["Forwarder outputs<br/>[outputs.conf]"]
end

subgraph group_analysis["SIEM analysis"]
  node_splunk["Splunk SIEM<br/>[start_splunk.sh]"]
  node_detection["Brute-force detection"]
  node_dashqueries["Dashboard queries"]
  node_dashboard["SOC dashboard"]
end

subgraph group_response["Incident response"]
  node_blockscript["IP block action<br/>[block_ip_ufw.sh]"]
  node_ufw["UFW firewall"]
end

node_attacker(("Kali attacker"))
node_analyst(("SOC analyst"))

node_attacker -->|"runs attack"| node_hydra
node_hydra -->|"attempts SSH"| node_ssh
node_ssh -->|"records failures"| node_authlogs
node_authlogs -->|"forwards logs"| node_forwarder
node_inputs -.->|"configures inputs"| node_forwarder
node_forwarder -.->|"uses outputs"| node_outputs
node_forwarder -->|"sends logs"| node_splunk
node_splunk -->|"searches events"| node_detection
node_splunk -->|"analyzes events"| node_dashqueries
node_dashqueries -->|"visualizes results"| node_dashboard
node_analyst -.->|"reviews results"| node_dashboard
node_analyst -->|"initiates response"| node_blockscript
node_blockscript -->|"blocks source IP"| node_ufw

click node_hydra "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/run_hydra_attack.sh"
click node_ssh "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/ssh_config.txt"
click node_authlogs "https://github.com/shakthivelb/splunk-soc-home-lab/tree/main/logs"
click node_inputs "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/inputs.conf"
click node_forwarder "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/start_forwarder.sh"
click node_outputs "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/outputs.conf"
click node_splunk "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/start_splunk.sh"
click node_detection "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/detection/brute_force_detection.spl"
click node_dashqueries "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/detection/dashboard_queries.spl"
click node_dashboard "https://github.com/shakthivelb/splunk-soc-home-lab/tree/main/detection"
click node_blockscript "https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/block_ip_ufw.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_hydra toneBlue
class node_ssh,node_authlogs,node_inputs,node_forwarder,node_outputs toneAmber
class node_splunk,node_detection,node_dashqueries,node_dashboard toneMint
class node_blockscript,node_ufw toneRose
class node_attacker,node_analyst toneIndigo
```

## Components

### Attack simulation

- [Hydra attack](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/run_hydra_attack.sh): `scripts/run_hydra_attack.sh`

### Target and collection

- [SSH target](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/ssh_config.txt): `configuration/ssh_config.txt`
- [Authentication logs](https://github.com/shakthivelb/splunk-soc-home-lab/tree/main/logs): `logs`
- [Log inputs](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/inputs.conf): `configuration/inputs.conf`
- [Universal Forwarder](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/start_forwarder.sh): `scripts/start_forwarder.sh`
- [Forwarder outputs](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/configuration/outputs.conf): `configuration/outputs.conf`

### SIEM analysis

- [Splunk SIEM](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/start_splunk.sh): `scripts/start_splunk.sh`
- [Brute-force detection](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/detection/brute_force_detection.spl): `detection/brute_force_detection.spl`
- [Dashboard queries](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/detection/dashboard_queries.spl): `detection/dashboard_queries.spl`
- [SOC dashboard](https://github.com/shakthivelb/splunk-soc-home-lab/tree/main/detection): `detection`

### Incident response

- [IP block action](https://github.com/shakthivelb/splunk-soc-home-lab/blob/main/scripts/block_ip_ufw.sh): `scripts/block_ip_ufw.sh`
- **UFW firewall**

### Other components

- **Kali attacker**
- **SOC analyst**

## Connections

- Kali attacker → Hydra attack: runs attack (evidence: `README.md`)
- Hydra attack → SSH target: attempts SSH (evidence: `README.md`)
- SSH target → Authentication logs: records failures (evidence: `README.md`)
- Authentication logs → Universal Forwarder: forwards logs (evidence: `README.md`)
- Log inputs → Universal Forwarder: configures inputs
- Universal Forwarder → Forwarder outputs: uses outputs
- Universal Forwarder → Splunk SIEM: sends logs (evidence: `README.md`)
- Splunk SIEM → Brute-force detection: searches events (evidence: `README.md`)
- Splunk SIEM → Dashboard queries: analyzes events (evidence: `README.md`)
- Dashboard queries → SOC dashboard: visualizes results (evidence: `README.md`)
- SOC analyst → SOC dashboard: reviews results
- SOC analyst → IP block action: initiates response (evidence: `README.md`)
- IP block action → UFW firewall: blocks source IP (evidence: `README.md`)