# shasaank-s/wazuh-soc-home-lab architecture

> Architecture diagram of the GitHub repository shasaank-s/wazuh-soc-home-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/shasaank-s/wazuh-soc-home-lab
- Repository: https://github.com/shasaank-s/wazuh-soc-home-lab

## Overview

This repository documents a Wazuh SOC home lab rather than implementing software. Its main workflow is Windows endpoint telemetry reaching an Ubuntu Wazuh Manager, where events are analyzed and file events are enriched with VirusTotal; Kali Nmap and Hydra activity provides adversary emulation for detection validation. The README also describes FIM and the Wazuh Dashboard. No source excerpts or configuration files were provided, so the graph reflects documented relationships only; README paths identify the evidence, not implementation code.

Main entry points: [`README.md`](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md) (Bridged Network)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lab["Lab Infrastructure"]
  node_windows["Windows 11 Host<br/>[README.md]"]
  node_ubuntu["Ubuntu VM<br/>[README.md]"]
  node_bridge["Bridged Network<br/>[README.md]"]
  node_virtualbox["VirtualBox<br/>[README.md]"]
end

subgraph group_endpoint["Endpoint Telemetry"]
  node_agent["Wazuh Agent<br/>[README.md]"]
  node_sysmon["Sysmon<br/>[README.md]"]
  node_eventlogs["Windows Event Channels<br/>[README.md]"]
  node_fim["File Integrity Monitoring<br/>[README.md]"]
end

subgraph group_analysis["Detection and Enrichment"]
  node_manager["Wazuh Manager<br/>[README.md]"]
  node_indexer[("Wazuh Indexer<br/>[README.md]")]
  node_dashboard["Wazuh Dashboard<br/>[README.md]"]
  node_virustotal["VirusTotal API<br/>[README.md]"]
end

subgraph group_emulation["Threat Emulation"]
  node_kali(("Kali Attacker<br/>[README.md]"))
  node_nmap["Nmap Recon<br/>[README.md]"]
  node_hydra["Hydra Brute Force<br/>[README.md]"]
end

node_analyst(("Lab Operator"))

node_virtualbox -->|"hosts network"| node_bridge
node_windows -->|"connects through"| node_bridge
node_ubuntu -->|"connects through"| node_bridge
node_kali -->|"connects through"| node_bridge
node_windows -->|"runs"| node_agent
node_windows -->|"runs"| node_sysmon
node_sysmon -->|"writes events"| node_eventlogs
node_eventlogs -->|"forwards channels"| node_agent
node_agent -->|"ships telemetry"| node_manager
node_ubuntu -->|"runs"| node_manager
node_ubuntu -->|"runs"| node_indexer
node_ubuntu -->|"runs"| node_dashboard
node_manager -->|"enriches file events"| node_virustotal
node_manager -.->|"presents alerts"| node_dashboard
node_manager -->|"monitors files"| node_fim
node_kali -->|"runs"| node_nmap
node_kali -->|"runs"| node_hydra
node_nmap -->|"scans environment"| node_bridge
node_hydra -->|"attacks SSH"| node_bridge
node_analyst -.->|"reviews detections"| node_dashboard

click node_windows "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_ubuntu "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_bridge "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_virtualbox "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_agent "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_sysmon "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_eventlogs "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_fim "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_manager "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_indexer "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_dashboard "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_virustotal "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_kali "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_nmap "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"
click node_hydra "https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_windows,node_ubuntu,node_bridge,node_virtualbox toneBlue
class node_agent,node_sysmon,node_eventlogs,node_fim toneAmber
class node_manager,node_indexer,node_dashboard,node_virustotal toneMint
class node_kali,node_nmap,node_hydra toneRose
class node_analyst toneIndigo
```

## Components

### Lab Infrastructure

- [Windows 11 Host](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Ubuntu VM](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Bridged Network](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [VirtualBox](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`

### Endpoint Telemetry

- [Wazuh Agent](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Sysmon](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Windows Event Channels](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [File Integrity Monitoring](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`

### Detection and Enrichment

- [Wazuh Manager](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Wazuh Indexer](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Wazuh Dashboard](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [VirusTotal API](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`

### Threat Emulation

- [Kali Attacker](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Nmap Recon](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`
- [Hydra Brute Force](https://github.com/shasaank-s/wazuh-soc-home-lab/blob/main/README.md): `README.md`

### Other components

- **Lab Operator**

## Connections

- VirtualBox → Bridged Network: hosts network (evidence: `README.md`)
- Windows 11 Host → Bridged Network: connects through (evidence: `README.md`)
- Ubuntu VM → Bridged Network: connects through (evidence: `README.md`)
- Kali Attacker → Bridged Network: connects through (evidence: `README.md`)
- Windows 11 Host → Wazuh Agent: runs (evidence: `README.md`)
- Windows 11 Host → Sysmon: runs (evidence: `README.md`)
- Sysmon → Windows Event Channels: writes events (evidence: `README.md`)
- Windows Event Channels → Wazuh Agent: forwards channels (evidence: `README.md`)
- Wazuh Agent → Wazuh Manager: ships telemetry (evidence: `README.md`)
- Ubuntu VM → Wazuh Manager: runs (evidence: `README.md`)
- Ubuntu VM → Wazuh Indexer: runs (evidence: `README.md`)
- Ubuntu VM → Wazuh Dashboard: runs (evidence: `README.md`)
- Wazuh Manager → VirusTotal API: enriches file events (evidence: `README.md`)
- Wazuh Manager → Wazuh Dashboard: presents alerts
- Wazuh Manager → File Integrity Monitoring: monitors files (evidence: `README.md`)
- Kali Attacker → Nmap Recon: runs (evidence: `README.md`)
- Kali Attacker → Hydra Brute Force: runs (evidence: `README.md`)
- Nmap Recon → Bridged Network: scans environment (evidence: `README.md`)
- Hydra Brute Force → Bridged Network: attacks SSH (evidence: `README.md`)
- Lab Operator → Wazuh Dashboard: reviews detections