How taronvardanyan/cs-home-lab works
This repository documents a home SOC lab: endpoint agents report to Wazuh, a gateway inspects client traffic with Suricata and forwards alerts, and Greenbone/OpenVAS scans lab systems. The graph follows the documented final architecture and notable configuration roles; implementation details beyond the available tree and README are not inferred.
Main entry points: part-1-wazuh-siem/README.md Wazuh manager · setup-gateway.sh Ubuntu gateway · part-3-openvas/README.md Greenbone scanner · suricata.yaml.snippet Suricata sensor
Components 19
Lab Network
- Kali attacker
- Ubuntu endpoint
- Windows endpoint
- UTM networks
README.md - Network addressing
part-2-suricata-nids/configs/netplan
Wazuh SIEM
- Mac Docker host
README.md - Wazuh manager
part-1-wazuh-siem/README.md - Wazuh indexer
part-1-wazuh-siem/README.md - Wazuh dashboard
part-1-wazuh-siem/README.md - Wazuh agents
part-1-wazuh-siem/README.md - Active Response config
part-1-wazuh-siem/configs/manager-active-response.xml - Custom drop action
part-1-wazuh-siem/configs/custom-drop.sh
Network Detection
- Ubuntu gateway
part-2-suricata-nids/configs/gateway/setup-gateway.sh - Suricata sensor
part-2-suricata-nids/configs/suricata/suricata.yaml.snippet - Suricata rules
part-2-suricata-nids/configs/suricata/local.rules - EVE alert logging
part-2-suricata-nids/configs/wazuh/agent-suricata-localfile.xml - Suricata alert rules
part-2-suricata-nids/configs/wazuh/local_rules.xml
Vulnerability Scanning
- Greenbone scanner
part-3-openvas/README.md - Scanner port mapping
part-3-openvas/configs/docker-compose-port-fix.yml
Connections 22
- Kali attacker → Ubuntu gateway: sends test traffic
- Ubuntu endpoint → Ubuntu gateway: client traffic
- Windows endpoint → Ubuntu gateway: client traffic
- UTM networks → Ubuntu gateway: connects networks
- Network addressing → Ubuntu gateway: configures interfaces
- Ubuntu gateway → Suricata sensor: passes LAN traffic
- Suricata rules → Suricata sensor: defines detections
- Suricata sensor → EVE alert logging: writes EVE alerts
- EVE alert logging → Wazuh agents: configured log input
- Wazuh agents → Wazuh manager: sends agent data
- Ubuntu gateway → Wazuh manager: forwards agent data
- Suricata alert rules → Wazuh manager: defines alert rules
- Wazuh manager → Wazuh indexer: stores events
- Wazuh manager → Wazuh dashboard: serves monitoring
- Active Response config → Wazuh manager: configures response
- Wazuh manager → Custom drop action: dispatches response
- Mac Docker host → Wazuh manager: hosts stack
- Mac Docker host → Greenbone scanner: hosts scanner
- Greenbone scanner → Kali attacker: scans target
- Greenbone scanner → Ubuntu endpoint: scans target
- Greenbone scanner → Windows endpoint: scans target
- Scanner port mapping → Greenbone scanner: configures port mapping