# zayan9484/soc-detection-engineering architecture

> Architecture diagram of the GitHub repository zayan9484/soc-detection-engineering, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zayan9484/soc-detection-engineering
- Repository: https://github.com/zayan9484/soc-detection-engineering

## Overview

This repository documents a controlled SOC detection engineering lab, not a standalone software application. Its principal workflow is to generate simulated activity, collect network and endpoint telemetry, detect or correlate events in Suricata and Wazuh, then investigate alerts and document validation and remediation. The graph includes the README’s network, authentication, FIM, and Sysmon detection branches. Relationships reflect documented data flow; implementation details beyond the supplied tree and documentation are not inferred.

Main entry points: [`investigations`](https://github.com/zayan9484/soc-detection-engineering/tree/main/investigations) (Alert Investigations), [`scenarios`](https://github.com/zayan9484/soc-detection-engineering/tree/main/scenarios) (Network Traffic), [`scenarios/03-ssh-bruteforce-detection.md`](https://github.com/zayan9484/soc-detection-engineering/blob/main/scenarios/03-ssh-bruteforce-detection.md) (Linux Auth Logs), [`scenarios/04-windows-bruteforce-detection.md`](https://github.com/zayan9484/soc-detection-engineering/blob/main/scenarios/04-windows-bruteforce-detection.md) (Windows Security Events)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_activity["Lab Activity"]
  node_kali(("Kali Simulator"))
  node_linux["Ubuntu Endpoint"]
  node_windows["Windows Endpoint"]
end

subgraph group_telemetry["Telemetry Collection"]
  node_traffic["Network Traffic"]
  node_authlogs["Linux Auth Logs"]
  node_winlogs["Windows Security Events"]
  node_fimconfig["FIM Configuration"]
  node_sysmonconfig["Sysmon Wazuh Configuration"]
end

subgraph group_detection["Detection Analysis"]
  node_suricata["Suricata IDS"]
  node_suricatarules["Custom Suricata Rules"]
  node_sysmon["Sysmon"]
  node_wazuh["Wazuh SIEM"]
  node_wazuhrules["Custom Wazuh Rules"]
end

subgraph group_response["Investigation Results"]
  node_analyst(("SOC Analyst"))
  node_investigations["Alert Investigations"]
  node_validation["Scenario Validation"]
  node_results["Detection Summary"]
  node_remediation["Remediation Analysis"]
end

node_kali -->|"simulates activity"| node_linux
node_linux -->|"generates"| node_traffic
node_windows -->|"generates"| node_traffic
node_linux -->|"records logons"| node_authlogs
node_windows -->|"records logons"| node_winlogs
node_traffic -->|"monitored by"| node_suricata
node_suricatarules -->|"defines signatures"| node_suricata
node_suricata -->|"forwards alerts"| node_wazuh
node_authlogs -->|"provides telemetry"| node_wazuh
node_winlogs -->|"provides telemetry"| node_wazuh
node_windows -->|"provides process events"| node_sysmon
node_sysmon -->|"forwards telemetry"| node_wazuh
node_sysmonconfig -->|"configures collection"| node_wazuh
node_fimconfig -->|"configures FIM"| node_wazuh
node_wazuhrules -->|"defines correlation"| node_wazuh
node_wazuh -->|"presents alerts"| node_analyst
node_analyst -->|"investigates alerts"| node_investigations
node_analyst -->|"validates detections"| node_validation
node_investigations -->|"informs"| node_remediation
node_validation -->|"documents outcomes"| node_results
node_investigations -->|"summarized in"| node_results

click node_traffic "https://github.com/zayan9484/soc-detection-engineering/tree/main/scenarios"
click node_authlogs "https://github.com/zayan9484/soc-detection-engineering/blob/main/scenarios/03-ssh-bruteforce-detection.md"
click node_winlogs "https://github.com/zayan9484/soc-detection-engineering/blob/main/scenarios/04-windows-bruteforce-detection.md"
click node_fimconfig "https://github.com/zayan9484/soc-detection-engineering/blob/main/configs/windows-fim-config.xml"
click node_sysmonconfig "https://github.com/zayan9484/soc-detection-engineering/blob/main/configs/windows-sysmon-wazuh-config.xml"
click node_suricatarules "https://github.com/zayan9484/soc-detection-engineering/blob/main/detection-rules/suricata-local.rules"
click node_wazuhrules "https://github.com/zayan9484/soc-detection-engineering/blob/main/detection-rules/wazuh-windows-rules.xml"
click node_investigations "https://github.com/zayan9484/soc-detection-engineering/tree/main/investigations"
click node_validation "https://github.com/zayan9484/soc-detection-engineering/tree/main/scenarios"
click node_results "https://github.com/zayan9484/soc-detection-engineering/blob/main/results/detection-summary.md"
click node_remediation "https://github.com/zayan9484/soc-detection-engineering/tree/main/investigations"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_kali,node_linux,node_windows toneBlue
class node_traffic,node_authlogs,node_winlogs,node_fimconfig,node_sysmonconfig toneAmber
class node_suricata,node_suricatarules,node_sysmon,node_wazuh,node_wazuhrules toneMint
class node_analyst,node_investigations,node_validation,node_results,node_remediation toneRose
```

## Components

### Lab Activity

- **Kali Simulator**
- **Ubuntu Endpoint**
- **Windows Endpoint**

### Telemetry Collection

- [Network Traffic](https://github.com/zayan9484/soc-detection-engineering/tree/main/scenarios): `scenarios`
- [Linux Auth Logs](https://github.com/zayan9484/soc-detection-engineering/blob/main/scenarios/03-ssh-bruteforce-detection.md): `scenarios/03-ssh-bruteforce-detection.md`
- [Windows Security Events](https://github.com/zayan9484/soc-detection-engineering/blob/main/scenarios/04-windows-bruteforce-detection.md): `scenarios/04-windows-bruteforce-detection.md`
- [FIM Configuration](https://github.com/zayan9484/soc-detection-engineering/blob/main/configs/windows-fim-config.xml): `configs/windows-fim-config.xml`
- [Sysmon Wazuh Configuration](https://github.com/zayan9484/soc-detection-engineering/blob/main/configs/windows-sysmon-wazuh-config.xml): `configs/windows-sysmon-wazuh-config.xml`

### Detection Analysis

- **Suricata IDS**
- [Custom Suricata Rules](https://github.com/zayan9484/soc-detection-engineering/blob/main/detection-rules/suricata-local.rules): `detection-rules/suricata-local.rules`
- **Sysmon**
- **Wazuh SIEM**
- [Custom Wazuh Rules](https://github.com/zayan9484/soc-detection-engineering/blob/main/detection-rules/wazuh-windows-rules.xml): `detection-rules/wazuh-windows-rules.xml`

### Investigation Results

- **SOC Analyst**
- [Alert Investigations](https://github.com/zayan9484/soc-detection-engineering/tree/main/investigations): `investigations`
- [Scenario Validation](https://github.com/zayan9484/soc-detection-engineering/tree/main/scenarios): `scenarios`
- [Detection Summary](https://github.com/zayan9484/soc-detection-engineering/blob/main/results/detection-summary.md): `results/detection-summary.md`
- [Remediation Analysis](https://github.com/zayan9484/soc-detection-engineering/tree/main/investigations): `investigations`

## Connections

- Kali Simulator → Ubuntu Endpoint: simulates activity
- Ubuntu Endpoint → Network Traffic: generates
- Windows Endpoint → Network Traffic: generates
- Ubuntu Endpoint → Linux Auth Logs: records logons
- Windows Endpoint → Windows Security Events: records logons
- Network Traffic → Suricata IDS: monitored by
- Custom Suricata Rules → Suricata IDS: defines signatures
- Suricata IDS → Wazuh SIEM: forwards alerts
- Linux Auth Logs → Wazuh SIEM: provides telemetry
- Windows Security Events → Wazuh SIEM: provides telemetry
- Windows Endpoint → Sysmon: provides process events
- Sysmon → Wazuh SIEM: forwards telemetry
- Sysmon Wazuh Configuration → Wazuh SIEM: configures collection
- FIM Configuration → Wazuh SIEM: configures FIM
- Custom Wazuh Rules → Wazuh SIEM: defines correlation
- Wazuh SIEM → SOC Analyst: presents alerts
- SOC Analyst → Alert Investigations: investigates alerts
- SOC Analyst → Scenario Validation: validates detections
- Alert Investigations → Remediation Analysis: informs
- Scenario Validation → Detection Summary: documents outcomes
- Alert Investigations → Detection Summary: summarized in