# vuducanhnguyen/soc-homelab architecture

> Architecture diagram of the GitHub repository vuducanhnguyen/soc-homelab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/vuducanhnguyen/soc-homelab
- Repository: https://github.com/vuducanhnguyen/soc-homelab

## Overview

This repository documents a SOC homelab whose main workflow runs from endpoint telemetry, through Wazuh detection and alerting, to Shuffle-driven enrichment and incident response. The response branches include TheHive case management, pfSense IP blocking, and Wazuh active response for host isolation. The README documents additional network, dashboard, and threat-simulation capabilities; the tree provides configuration and workflow artifacts rather than the full platforms, so links between those components follow documented integrations, not inspected platform code.

Main entry points: [`Wazuh_config/ossec.conf`](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/ossec.conf) (Wazuh manager), [`Shuffle`](https://github.com/vuducanhnguyen/soc-homelab/tree/main/Shuffle) (Shuffle workflows), [`Wazuh_config`](https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config) (Wazuh agent), [`Shuffle/Active_response_pfSense_block.py`](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Shuffle/Active_response_pfSense_block.py) (pfSense firewall)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_monitoring["Monitoring & Detection"]
  node_sysmon["Sysmon & OpenSSH"]
  node_agent["Wazuh agent"]
  node_manager["Wazuh manager<br/>[ossec.conf]"]
  node_decoders["Local decoders<br/>[local_decoder.xml]"]
  node_rules["Local rules<br/>[local_rules.xml]"]
  node_indexer[("Wazuh indexer")]
  node_dashboard["Wazuh dashboard"]
end

subgraph group_orchestration["SOAR &amp; Incidents"]
  node_shuffle["Shuffle workflows"]
  node_thehive["TheHive cases"]
  node_virustotal["VirusTotal API"]
  node_email["Email API"]
end

subgraph group_network["Network Security"]
  node_pfsense["pfSense firewall"]
  node_network_services["DHCP &amp; DNS"]
end

subgraph group_response["Response Actions"]
  node_active_config["Active response config<br/>[ossec.conf]"]
  node_isolate_cmd["Isolation commands<br/>[isolate-host.cmd]"]
  node_isolate_script["Isolation script<br/>[isolate-host.ps1]"]
end

node_attacker(("Kali attacker"))
node_endpoint(("Windows endpoint"))
node_analyst(("SOC analyst"))

node_attacker -.->|"simulates attacks"| node_endpoint
node_sysmon -->|"sends events"| node_agent
node_endpoint -->|"forwards logs"| node_agent
node_agent -->|"transmits logs"| node_manager
node_manager -->|"decodes events"| node_decoders
node_manager -->|"matches rules"| node_rules
node_manager -->|"indexes alerts"| node_indexer
node_dashboard -->|"queries data"| node_indexer
node_analyst -->|"investigates alerts"| node_dashboard
node_manager -->|"sends webhooks"| node_shuffle
node_shuffle -->|"creates cases"| node_thehive
node_shuffle -->|"enriches indicators"| node_virustotal
node_shuffle -->|"sends notifications"| node_email
node_shuffle -->|"blocks IPs"| node_pfsense
node_pfsense -->|"protects subnets"| node_network_services
node_manager -->|"dispatches response"| node_active_config
node_active_config -->|"invokes command"| node_isolate_cmd
node_active_config -->|"invokes script"| node_isolate_script
node_manager -->|"sends response"| node_agent
node_agent -->|"isolates host"| node_endpoint

click node_agent "https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config"
click node_manager "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/ossec.conf"
click node_decoders "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/local_decoder.xml"
click node_rules "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/local_rules.xml"
click node_indexer "https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config"
click node_dashboard "https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config"
click node_shuffle "https://github.com/vuducanhnguyen/soc-homelab/tree/main/Shuffle"
click node_thehive "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Shuffle/TheHive_Bruteforce_SSH_body.json"
click node_pfsense "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Shuffle/Active_response_pfSense_block.py"
click node_active_config "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/ossec.conf"
click node_isolate_cmd "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/isolate-host.cmd"
click node_isolate_script "https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/isolate-host.ps1"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_sysmon,node_agent,node_manager,node_decoders,node_rules,node_indexer,node_dashboard toneBlue
class node_shuffle,node_thehive,node_virustotal,node_email toneAmber
class node_pfsense,node_network_services toneMint
class node_active_config,node_isolate_cmd,node_isolate_script toneRose
class node_attacker,node_endpoint,node_analyst toneIndigo
```

## Components

### Monitoring & Detection

- **Sysmon & OpenSSH**
- [Wazuh agent](https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config): `Wazuh_config`
- [Wazuh manager](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/ossec.conf): `Wazuh_config/ossec.conf`
- [Local decoders](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/local_decoder.xml): `Wazuh_config/local_decoder.xml`
- [Local rules](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/local_rules.xml): `Wazuh_config/local_rules.xml`
- [Wazuh indexer](https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config): `Wazuh_config`
- [Wazuh dashboard](https://github.com/vuducanhnguyen/soc-homelab/tree/main/Wazuh_config): `Wazuh_config`

### SOAR & Incidents

- [Shuffle workflows](https://github.com/vuducanhnguyen/soc-homelab/tree/main/Shuffle): `Shuffle`
- [TheHive cases](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Shuffle/TheHive_Bruteforce_SSH_body.json): `Shuffle/TheHive_Bruteforce_SSH_body.json`
- **VirusTotal API**
- **Email API**

### Network Security

- [pfSense firewall](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Shuffle/Active_response_pfSense_block.py): `Shuffle/Active_response_pfSense_block.py`
- **DHCP & DNS**

### Response Actions

- [Active response config](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/ossec.conf): `Wazuh_config/ossec.conf`
- [Isolation commands](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/isolate-host.cmd): `Wazuh_config/isolate-host.cmd`
- [Isolation script](https://github.com/vuducanhnguyen/soc-homelab/blob/main/Wazuh_config/isolate-host.ps1): `Wazuh_config/isolate-host.ps1`

### Other components

- **Kali attacker**
- **Windows endpoint**
- **SOC analyst**

## Connections

- Kali attacker → Windows endpoint: simulates attacks
- Sysmon & OpenSSH → Wazuh agent: sends events
- Windows endpoint → Wazuh agent: forwards logs
- Wazuh agent → Wazuh manager: transmits logs
- Wazuh manager → Local decoders: decodes events
- Wazuh manager → Local rules: matches rules
- Wazuh manager → Wazuh indexer: indexes alerts
- Wazuh dashboard → Wazuh indexer: queries data
- SOC analyst → Wazuh dashboard: investigates alerts
- Wazuh manager → Shuffle workflows: sends webhooks
- Shuffle workflows → TheHive cases: creates cases
- Shuffle workflows → VirusTotal API: enriches indicators
- Shuffle workflows → Email API: sends notifications
- Shuffle workflows → pfSense firewall: blocks IPs
- pfSense firewall → DHCP & DNS: protects subnets
- Wazuh manager → Active response config: dispatches response
- Active response config → Isolation commands: invokes command
- Active response config → Isolation script: invokes script
- Wazuh manager → Wazuh agent: sends response
- Wazuh agent → Windows endpoint: isolates host