vuducanhnguyen/soc-homelab

This repository documents a SOC homelab whose main workflow runs from endpoint telemetry, through Wazuh detection and alerting, to Shuffle-driven enrichment and incident response. The response branches include TheHive case management, pfSense IP blocking, and Wazuh active response for host isolation. The README documents additional network, dashboard, and threat-simulation capabilities; the tree provides configuration and workflow artifacts rather than the full platforms, so links between those components follow documented integrations, not inspected platform code.