← Back to SOC Portfolio

SOC Lab Overview

Executive Summary

This SOC lab is a multi-VM enterprise-style cybersecurity environment built in VMware Workstation. It integrates endpoint security, network monitoring, availability monitoring, metrics, dashboards, Windows identity infrastructure, and controlled attack simulation.

The lab is designed to show more than tool installation. It demonstrates how attacks produce evidence across multiple layers and how a SOC analyst correlates those signals into a single incident story.

Systems

SystemIPRole
Security Onion192.168.117.10Network detection, Suricata, Zeek, PCAP, Hunt
Ubuntu192.168.117.30Linux monitored node, web/SSH target, monitoring services
Nagios192.168.117.30Availability monitoring
Prometheus192.168.117.30:9090Metrics collection
Grafana192.168.117.30:3000Dashboards and visualization
Wazuh192.168.117.50SIEM and endpoint telemetry
Kali192.168.117.129Attacker VM
DC01192.168.117.130Windows Server 2025 AD DS, DNS, Kerberos
Win11Client192.168.117.100Domain-joined Windows endpoint
Win11 NAT192.168.20.133Internet/update interface

Monitoring Philosophy

LayerToolQuestion Answered
NetworkSecurity OnionWhat happened on the wire?
Endpoint / SIEMWazuhWhat happened on the host?
AvailabilityNagiosIs the service up?
MetricsPrometheusHow is the system performing?
VisualizationGrafanaWhat does the trend/dashboard show?

Core Value

The strongest part of this lab is cross-tool correlation:

  1. Kali triggers attack activity.
  2. Ubuntu, Win11, or DC01 generates logs.
  3. Wazuh detects endpoint events.
  4. Security Onion shows network evidence.
  5. Prometheus collects metrics.
  6. Grafana visualizes impact.
  7. Nagios validates availability.
  8. Analyst builds an incident timeline.

Key Portfolio Assets