🛡️ Home SOC Lab — Documentation
Goal: Build a fully functional SOC environment on physical hardware to practice incident detection, log analysis, and investigation.
Context
As part of my transition into defensive cybersecurity, I built a complete SOC home lab on recycled physical hardware.
The goal is to replicate a realistic enterprise-like environment to practice core SOC analyst skills: alert triage, log analysis, attack detection, and incident report writing.
Hardware
| Machine | Role | Specs |
|---|---|---|
| Lenovo ThinkCentre M910Q | Main server (hypervisor host) | 16 GB RAM, 480 GB SSD |
| Lenovo ThinkPad X230 | Workstation / administration | ParrotOS |
Network Architecture
Traffic path: Internet -> Home Router -> pfSense WAN (192.168.1.37) -> pfSense LAN (192.168.10.1) -> Lab hosts
| Host | IP address | Role |
|---|---|---|
| pfSense (WAN) | 192.168.1.37 | Edge firewall interface on home network |
| pfSense (LAN) | 192.168.10.1 | Gateway for isolated lab network |
| Wazuh Server | 192.168.10.100 | SIEM (manager, indexer, dashboard) |
| Kali Linux | 192.168.10.101 | Analyst / attacker workstation |
| Windows Server | 192.168.10.102 | Monitored target |
All lab traffic flows through pfSense, which acts as a firewall and router — mirroring a real enterprise network setup.
Tech Stack
🖥️ Proxmox VE — Hypervisor
- Installed bare metal on the ThinkCentre M910Q
- Manages all VMs through a web interface
- Accessible on the local network via port 8006
🔥 pfSense 2.8.1 — Firewall / Router
- Isolates the lab network (192.168.10.x) from the home network (192.168.1.x)
- Assigns IP addresses to VMs via DHCP
- Simulates enterprise firewall rules and network segmentation
- Generates network logs forwarded to Wazuh
🟠 Wazuh 4.11 — SIEM
- Installed on Ubuntu Server 24.04 LTS
- Components deployed: Manager, Indexer (OpenSearch), Dashboard
- Collects and correlates logs from connected agents
- Web interface available at https://192.168.10.100
🐉 Kali Linux 2026.1 — Analyst Workstation / Attacker
- Used to access the Wazuh dashboard and pfSense admin interface
- Used to simulate attacks (Nmap, Hydra)
- Enables full attack → detection → investigation cycles
🪟 Windows Server 2022 — Monitored Target
- Wazuh agent installed and active
- Generates Windows Event Logs forwarded to Wazuh
- Used to simulate realistic attack scenarios
Practiced Scenarios
✅ Scenario 1 — RDP Brute Force Attack
- Tool: Hydra with rockyou.txt wordlist
- Target: WIN-SERVER (192.168.10.102) — port 3389
- Detection: 175 Event ID 4625 alerts detected by Wazuh in under 60 seconds
- Report: INC-2026-0001
🔜 Upcoming Scenarios
- Kerberoasting / AS-REP Roasting (Active Directory)
- Lateral movement detection
- PCAP analysis with Wireshark
- Threat Hunting in Wazuh
Skills Developed
- Deploying and administering a hypervisor (Proxmox VE)
- Configuring a firewall (pfSense) — rules, DHCP, logging
- Deploying a SIEM (Wazuh) — manager, indexer, dashboard, agents
- Analyzing Windows Event Logs (Event ID 4625, 4624, 4648…)
- Simulating network attacks and detecting them in near real-time
- Writing structured incident reports
This lab is continuously evolving. Scenarios and documentation are updated regularly.