Virtual SOC Lab

Suricata IDS Integrated with Elastic SIEM Stack

Project Summary

This project demonstrates the design, deployment, and validation of a Virtual Security Operations Centre (SOC) lab using open-source security tools.

The lab objective was to:

• Deploy a Network Intrusion Detection System (Suricata)
• Integrate it with a SIEM platform (Elastic Stack)
• Simulate reconnaissance attacks
• Detect, forward, and visualize security alerts
• Validate an end-to-end threat detection workflow

The lab successfully detects reconnaissance scans (for example, Nmap SYN scans) and visualizes alerts in Kibana.

Objectives

• Configure a secure virtual network environment
• Deploy Suricata as a network IDS
• Enable and manage threat detection rules
• Simulate attack traffic from an attacker VM
• Forward IDS logs to Elasticsearch using Filebeat
• Visualize and analyze alerts in Kibana
• Validate real-time detection capability

Lab Architecture

Architecture Overview

1. Attacker VM generates malicious or test network traffic.
2. Suricata IDS server monitors traffic and writes alerts/logs.
3. Filebeat collects Suricata logs and ships them to Elasticsearch.
4. Elasticsearch indexes and stores security events.
5. Kibana visualizes events for investigation and monitoring.

Components

Attacker Machine

• OS: Ubuntu 24.04
• Tool: Nmap
• Role: Simulate reconnaissance attacks

IDS Server

• OS: Ubuntu 24.04
• Suricata
• Elasticsearch 8.x
• Kibana 8.x
• Filebeat

Environment Setup

Virtualization Platform

• Oracle VirtualBox
• Host-Only Networking mode
• Network range: 192.168.56.0/24

Machine Configuration

IDS Server

• RAM: 15 GB
• OS: Ubuntu 24.04 LTS
• Monitored interface: enp0s8

Attacker VM

• RAM: 10 GB
• OS: Ubuntu 24.04 LTS

Network Configuration

Adapter Configuration

• Adapter 1: Host-Only Adapter (Promiscuous Mode enabled)
• Adapter 2: NAT (internet access for package downloads)

Assigned IP Addresses

• IDS Server: 192.168.56.103
• Attacker VM: 192.168.56.102

Connectivity Verification

ping 192.168.56.103
tcpdump -i enp0s8

Suricata Deployment

Installation

sudo apt update
sudo apt install suricata -y

Rule Management

Enabled Emerging Threats Open ruleset:

sudo suricata-update enable-source et/open
sudo suricata-update update-sources
sudo suricata-update

Loaded rules: ~48,000+ detection rules.

Interface Configuration

Configured Suricata to monitor enp0s8.

Verification:

sudo suricata -T -c /etc/suricata/suricata.yaml -i enp0s8

Service Validation

sudo systemctl status suricata

Confirmed active and running.

Attack Simulation

Attack traffic generated from attacker VM:

nmap -sS 192.168.56.103
nmap -A 192.168.56.103

Observed Detection

• ET SCAN NMAP OS Detection Probe
• TCP SYN scan patterns
• Reconnaissance alerts

Verified alerts in:

• /var/log/suricata/fast.log
• /var/log/suricata/eve.json

Elastic Stack Deployment

Elasticsearch

Configured as a single-node cluster:

discovery.type: single-node

Verified cluster status:

curl -k -u elastic:<password> https://localhost:9200

Cluster returned a healthy response.

Kibana

Connected to Elasticsearch using an enrollment token.

Verified access via: http://192.168.56.103:5601

Created data view: filebeat-*

Filebeat Configuration

Module Activation

sudo filebeat modules enable suricata

Enabled eve fileset:

enabled: true
var.paths: ["/var/log/suricata/eve.json"]

Setup

sudo filebeat setup

Service Start

sudo systemctl enable filebeat
sudo systemctl start filebeat

Verified ingestion:

sudo filebeat test output

Log Flow Validation

Confirmed full pipeline:

1. Nmap scan executed
2. Suricata generated alert
3. eve.json updated
4. Filebeat forwarded log
5. Elasticsearch indexed event
6. Kibana displayed detection

Detection Analysis

Example alert:

• ET SCAN NMAP OS Detection Probe

Mapped to MITRE ATT&CK:

• T1595 - Active Scanning

• T1046 - Network Service Scanning

• Severity: Medium

• Classification: Attempted Information Leak

Troubleshooting Performed

Issues resolved during setup:

• Suricata interface mismatch
• Missing ruleset loading
• Elasticsearch bootstrap error
• Kibana authentication issue
• Filebeat module misconfiguration (eve fileset disabled)

Diagnosis commands used:

systemctl status <service>
journalctl -u <service>

Skills Demonstrated

• Network configuration
• IDS deployment and rule management
• SIEM integration
• Log pipeline troubleshooting
• Threat detection validation
• Elastic security architecture

Outcome

Successfully implemented a working SOC lab capable of:

• Detecting reconnaissance attacks
• Centralizing IDS logs
• Visualizing security events
• Performing initial threat investigation

This lab simulates real-world SOC infrastructure used in enterprise environments.

Future Enhancements

• Add Zeek for network analysis
• Add Wazuh for host-based detection
• Create automated detection rules in Kibana
• Build custom dashboards
• Implement alert email notifications
• Deploy using Docker