A virtual SOC and detection-engineering case study
Status: Work in progress · Infrastructure, agent enrollment, and telemetry validation complete · SOC-001 testing in progress
This personal lab brings Windows and Linux endpoints into a Wazuh environment on a Windows desktop running Oracle VirtualBox. The infrastructure is working, both endpoint agents are visible in the dashboard, and Sysmon and SSH authentication events have been confirmed in Wazuh. Testing has started on the first detection case, SOC-001. The current milestone is to demonstrate the complete analyst workflow with evidence:
Generate controlled activity → collect telemetry → detect → investigate → improve.
This repository documents the foundation and the work ahead. No completed detection cases, incident investigations, or automation results are claimed in this version. This is a personal learning environment; it does not represent production SOC operations or employer experience.
- Establish reliable Windows and Linux telemetry and identify collection gaps.
- Build repeatable detection scenarios with explicit hypotheses and test criteria.
- Investigate alerts using timelines, affected assets, source activity, and supporting evidence.
- Explain false positives, visibility limits, and detection improvements.
- Map observed behavior to MITRE ATT&CK with a written rationale.
- Develop small parsing and enrichment utilities after the manual workflow is validated.
| Area | Status | Evidence boundary |
|---|---|---|
| VirtualBox and three VMs | Complete | Wazuh server, Windows 11 Pro, and Ubuntu Server are running. |
| Lab networking | Complete | Host-only lab segment plus NAT adapters; VM addresses are 192.168.56.101–192.168.56.103. |
| Wazuh dashboard | Complete | Dashboard is accessible; both endpoint agents are visible. |
| Windows Wazuh Agent | Complete | Manual client-key enrollment succeeded; service reported Running. |
| Ubuntu Wazuh Agent | Complete | Package installed with curl workaround; service reported active/running. |
| Sysmon and OpenSSH | Installed | Sysmon on Windows; OpenSSH on Ubuntu. |
| Event-source validation | Complete | Sysmon events and SSH authentication events confirmed in Wazuh. |
| Detections and investigations | In progress | SOC-001 testing has started; no test results or completed cases yet. |
| Automation | Planned | No scripts implemented in this repository. |
Status reflects the build record as of October 22, 2026. This documentation was prepared from that record; it is not a fresh inspection of the running VMs.
All three VMs run on one Windows desktop. Their host-only interfaces share the 192.168.56.0/24 lab segment. SOC-WAZUH-01 uses 192.168.56.101, WIN11-LAB uses 192.168.56.102, and UBUNTU-LAB uses 192.168.56.103. The Windows and Ubuntu agents connect to the Wazuh manager at 192.168.56.101. Separate NAT interfaces provide outbound internet access for updates and downloads. The host accesses the Wazuh dashboard through the host-only network.
The lab segment is separate from the physical LAN at the virtual network layer. The desktop still participates in it, and NAT permits outbound traffic; this is not an air-gapped environment. See the architecture and network boundaries for details.
| Component | Role in this case study |
|---|---|
| Windows desktop + Oracle VirtualBox | Hosts and manages the three VMs and virtual networks. |
Wazuh all-in-one VM (SOC-WAZUH-01) |
Central manager, indexer, and dashboard in one VM. |
Windows 11 Pro (WIN11-LAB) |
Windows endpoint with Wazuh Agent and Microsoft Sysmon. |
Ubuntu Server (UBUNTU-LAB) |
Linux endpoint with Wazuh Agent and OpenSSH. |
| Host-only networking + NAT | Lab communication and a separate outbound update path. |
| MITRE ATT&CK | Planned framework for explaining tested behavior; no coverage claim yet. |
The recorded Ubuntu agent package is 4.14.7-1 for amd64. Other installed versions and final resource allocations have not been inventoried here.
| VM | Host-only IP address | Role |
|---|---|---|
SOC-WAZUH-01 |
192.168.56.101 |
Wazuh manager, indexer, and dashboard |
WIN11-LAB |
192.168.56.102 |
Windows endpoint with Wazuh Agent and Sysmon |
UBUNTU-LAB |
192.168.56.103 |
Ubuntu endpoint with Wazuh Agent and OpenSSH |
SOC-001 testing is in progress; no results are recorded yet. The remaining scenarios are planned and untested in this repository. Proposed signals must be verified before writing detection logic or assigning ATT&CK mappings.
| Case | Scenario | Required telemetry | Analyst question |
|---|---|---|---|
| SOC-001 | Repeated SSH authentication failures on Ubuntu | SSH authentication records collected by Wazuh (validated) | Which source and accounts were involved, over what time window, and was there a later success? |
| SOC-002 | Test account added to local Administrators | Windows Security account and group-change events; audit settings required | Who granted privilege, to whom, and was it expected? |
| SOC-003 | Suspicious-looking PowerShell using harmless test content | Sysmon process creation and PowerShell logs, subject to collection configuration | What command ran, what launched it, and what context makes it suspicious? |
| SOC-004 | Scheduled task created for a benign test action | Task Scheduler/Security events and process telemetry, subject to configuration | What created the task and what would it execute? |
| SOC-005 | Small, scoped port scan between owned lab VMs | Suitable endpoint/firewall/network records; visibility must be established first | Can the available data show a pattern across destination ports? |
| SOC-006 | Change to a designated test file on Ubuntu | Wazuh file-integrity monitoring for an explicitly configured test path | What changed, when, and what attribution does the evidence actually support? |
The current design has no dedicated network sensor. SOC-005 depends on establishing suitable visibility; installing endpoint agents does not by itself prove scan detection.
- Build the three-VM environment and enroll both endpoints.
- Document the architecture and known setup lessons.
- Record the host-only IP address assigned to each VM.
- Inventory exact software versions, VM allocations, and existing recovery snapshots.
- Validate one Sysmon event and one SSH authentication event from source through Wazuh.
- Add the collection settings and sanitized evidence from that validation to this repository.
- Complete SOC-001 with a repeatable test, time window, actual observed rule/query results, and a benign comparison.
- Expand to the remaining scenarios only after their data sources are validated.
- Write at least three investigations covering timeline, evidence, interpretation, limitations, and response recommendations.
- Add tested parsing or enrichment utilities with sample lab-only inputs.
A detection is complete only when its write-up records the hypothesis, prerequisites, exact test activity, expected versus observed result, detection logic, false-positive considerations, and an ATT&CK rationale where applicable. An incident report must distinguish actions actually performed from proposed response steps. Successful enrollment and validated telemetry are the foundation for these milestones.
- Architecture: VM roles, network design, data flow, and limitations.
- Completed setup: infrastructure and enrollment record.
- Troubleshooting: issues encountered, causes or uncertainties, and resolutions.
home-soc-lab/
├── README.md
├── .gitignore
├── architecture/
│ ├── architecture.md
│ └── network-diagram.png
├── docs/
│ ├── setup.md
│ └── troubleshooting.md
├── detections/
│ └── .gitkeep
├── incident-reports/
│ └── .gitkeep
├── screenshots/
│ └── .gitkeep
└── scripts/
└── .gitkeep
The four placeholder directories intentionally contain no detections, reports, screenshots, or scripts yet.
No employer data or sensitive credentials should ever be published. Use only owned lab systems and lab-generated activity. Never include employer/customer logs, real incident details, passwords, Wazuh client authentication keys, API tokens, SSH private keys, or personal account information.
Review future screenshots, logs, command lines, and configuration exports before adding them. Redact secrets and identifying data while keeping enough context to explain the case. The private manager address shown here is intentional lab context. VM disks, snapshots, installers, and credential stores do not belong in this repository. The .gitignore provides basic exclusions; it does not replace content review.