# taronvardanyan/cs-home-lab architecture

> Architecture diagram of the GitHub repository taronvardanyan/cs-home-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/taronvardanyan/cs-home-lab
- Repository: https://github.com/taronvardanyan/cs-home-lab

## Overview

This repository documents a home SOC lab: endpoint agents report to Wazuh, a gateway inspects client traffic with Suricata and forwards alerts, and Greenbone/OpenVAS scans lab systems. The graph follows the documented final architecture and notable configuration roles; implementation details beyond the available tree and README are not inferred.

Main entry points: [`part-1-wazuh-siem/README.md`](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md) (Wazuh manager), [`part-2-suricata-nids/configs/gateway/setup-gateway.sh`](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/gateway/setup-gateway.sh) (Ubuntu gateway), [`part-3-openvas/README.md`](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-3-openvas/README.md) (Greenbone scanner), [`part-2-suricata-nids/configs/suricata/suricata.yaml.snippet`](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/suricata/suricata.yaml.snippet) (Suricata sensor)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lab["Lab Network"]
  node_kali(("Kali attacker"))
  node_ubuntu(("Ubuntu endpoint"))
  node_windows(("Windows endpoint"))
  node_utm["UTM networks<br/>[README.md]"]
  node_netplan["Network addressing"]
end

subgraph group_siem["Wazuh SIEM"]
  node_mac["Mac Docker host<br/>[README.md]"]
  node_wazuh["Wazuh manager<br/>[README.md]"]
  node_indexer[("Wazuh indexer<br/>[README.md]")]
  node_dashboard["Wazuh dashboard<br/>[README.md]"]
  node_agents["Wazuh agents<br/>[README.md]"]
  node_activeconfig["Active Response config"]
  node_drop["Custom drop action<br/>[custom-drop.sh]"]
end

subgraph group_nids["Network Detection"]
  node_gateway["Ubuntu gateway<br/>[setup-gateway.sh]"]
  node_suricata["Suricata sensor"]
  node_rules["Suricata rules<br/>[local.rules]"]
  node_eve["EVE alert logging"]
  node_wazuhrules["Suricata alert rules<br/>[local_rules.xml]"]
end

subgraph group_vuln["Vulnerability Scanning"]
  node_openvas["Greenbone scanner<br/>[README.md]"]
  node_portfix["Scanner port mapping"]
end

node_kali -->|"sends test traffic"| node_gateway
node_ubuntu -->|"client traffic"| node_gateway
node_windows -->|"client traffic"| node_gateway
node_utm -->|"connects networks"| node_gateway
node_netplan -->|"configures interfaces"| node_gateway
node_gateway -->|"passes LAN traffic"| node_suricata
node_rules -->|"defines detections"| node_suricata
node_suricata -->|"writes EVE alerts"| node_eve
node_eve -->|"configured log input"| node_agents
node_agents -->|"sends agent data"| node_wazuh
node_gateway -->|"forwards agent data"| node_wazuh
node_wazuhrules -->|"defines alert rules"| node_wazuh
node_wazuh -->|"stores events"| node_indexer
node_wazuh -->|"serves monitoring"| node_dashboard
node_activeconfig -->|"configures response"| node_wazuh
node_wazuh -->|"dispatches response"| node_drop
node_mac -->|"hosts stack"| node_wazuh
node_mac -->|"hosts scanner"| node_openvas
node_openvas -.->|"scans target"| node_kali
node_openvas -.->|"scans target"| node_ubuntu
node_openvas -.->|"scans target"| node_windows
node_portfix -->|"configures port mapping"| node_openvas

click node_utm "https://github.com/taronvardanyan/cs-home-lab/blob/main/README.md"
click node_gateway "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/gateway/setup-gateway.sh"
click node_netplan "https://github.com/taronvardanyan/cs-home-lab/tree/main/part-2-suricata-nids/configs/netplan"
click node_mac "https://github.com/taronvardanyan/cs-home-lab/blob/main/README.md"
click node_wazuh "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md"
click node_indexer "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md"
click node_dashboard "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md"
click node_agents "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md"
click node_activeconfig "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/configs/manager-active-response.xml"
click node_drop "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/configs/custom-drop.sh"
click node_suricata "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/suricata/suricata.yaml.snippet"
click node_rules "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/suricata/local.rules"
click node_eve "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/wazuh/agent-suricata-localfile.xml"
click node_wazuhrules "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/wazuh/local_rules.xml"
click node_openvas "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-3-openvas/README.md"
click node_portfix "https://github.com/taronvardanyan/cs-home-lab/blob/main/part-3-openvas/configs/docker-compose-port-fix.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_kali,node_ubuntu,node_windows,node_utm,node_netplan toneBlue
class node_mac,node_wazuh,node_indexer,node_dashboard,node_agents,node_activeconfig,node_drop toneAmber
class node_gateway,node_suricata,node_rules,node_eve,node_wazuhrules toneMint
class node_openvas,node_portfix toneRose
```

## Components

### Lab Network

- **Kali attacker**
- **Ubuntu endpoint**
- **Windows endpoint**
- [UTM networks](https://github.com/taronvardanyan/cs-home-lab/blob/main/README.md): `README.md`
- [Network addressing](https://github.com/taronvardanyan/cs-home-lab/tree/main/part-2-suricata-nids/configs/netplan): `part-2-suricata-nids/configs/netplan`

### Wazuh SIEM

- [Mac Docker host](https://github.com/taronvardanyan/cs-home-lab/blob/main/README.md): `README.md`
- [Wazuh manager](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md): `part-1-wazuh-siem/README.md`
- [Wazuh indexer](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md): `part-1-wazuh-siem/README.md`
- [Wazuh dashboard](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md): `part-1-wazuh-siem/README.md`
- [Wazuh agents](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/README.md): `part-1-wazuh-siem/README.md`
- [Active Response config](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/configs/manager-active-response.xml): `part-1-wazuh-siem/configs/manager-active-response.xml`
- [Custom drop action](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-1-wazuh-siem/configs/custom-drop.sh): `part-1-wazuh-siem/configs/custom-drop.sh`

### Network Detection

- [Ubuntu gateway](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/gateway/setup-gateway.sh): `part-2-suricata-nids/configs/gateway/setup-gateway.sh`
- [Suricata sensor](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/suricata/suricata.yaml.snippet): `part-2-suricata-nids/configs/suricata/suricata.yaml.snippet`
- [Suricata rules](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/suricata/local.rules): `part-2-suricata-nids/configs/suricata/local.rules`
- [EVE alert logging](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/wazuh/agent-suricata-localfile.xml): `part-2-suricata-nids/configs/wazuh/agent-suricata-localfile.xml`
- [Suricata alert rules](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-2-suricata-nids/configs/wazuh/local_rules.xml): `part-2-suricata-nids/configs/wazuh/local_rules.xml`

### Vulnerability Scanning

- [Greenbone scanner](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-3-openvas/README.md): `part-3-openvas/README.md`
- [Scanner port mapping](https://github.com/taronvardanyan/cs-home-lab/blob/main/part-3-openvas/configs/docker-compose-port-fix.yml): `part-3-openvas/configs/docker-compose-port-fix.yml`

## Connections

- Kali attacker → Ubuntu gateway: sends test traffic
- Ubuntu endpoint → Ubuntu gateway: client traffic
- Windows endpoint → Ubuntu gateway: client traffic
- UTM networks → Ubuntu gateway: connects networks
- Network addressing → Ubuntu gateway: configures interfaces
- Ubuntu gateway → Suricata sensor: passes LAN traffic
- Suricata rules → Suricata sensor: defines detections
- Suricata sensor → EVE alert logging: writes EVE alerts
- EVE alert logging → Wazuh agents: configured log input
- Wazuh agents → Wazuh manager: sends agent data
- Ubuntu gateway → Wazuh manager: forwards agent data
- Suricata alert rules → Wazuh manager: defines alert rules
- Wazuh manager → Wazuh indexer: stores events
- Wazuh manager → Wazuh dashboard: serves monitoring
- Active Response config → Wazuh manager: configures response
- Wazuh manager → Custom drop action: dispatches response
- Mac Docker host → Wazuh manager: hosts stack
- Mac Docker host → Greenbone scanner: hosts scanner
- Greenbone scanner → Kali attacker: scans target
- Greenbone scanner → Ubuntu endpoint: scans target
- Greenbone scanner → Windows endpoint: scans target
- Scanner port mapping → Greenbone scanner: configures port mapping