Lightweight SOC Home Lab for Low-End Computers & PCs
AetherSOC is a free forever, open-source Security Operations Center (SOC) home lab designed specifically for low-end computers, low-end PCs, and machines with limited RAM (works from ~6–8 GB upward).
It is the only public lab built around a Living Narrative Campaign Engine — continuous, timed, multi-stage attack stories that generate realistic telemetry over time so you can practice real SOC analyst and detection engineering skills.
Keywords this repo targets: low end computer SOC home lab, low end PC cybersecurity lab, lightweight SOC lab, low resource SOC home lab, free SOC lab for low-end machines.
Most SOC labs on GitHub require 16–32 GB RAM and give you static “run one attack” scenarios.
AetherSOC is different:
- Built for low-end computers / low-end PCs
- One straight path (no complicated modes)
- Living Narrative Campaigns that unfold automatically
- 100% free forever (open-source tools only)
- Single
docker composefocused workflow
| Component | Purpose |
|---|---|
| Wazuh (single-node) | SIEM / XDR – log collection, detection, dashboards |
| Suricata | Network IDS |
| Vulnerable targets | DVWA + OWASP Juice Shop |
| Narrative Campaign Engine | Timed multi-stage attack stories that generate real telemetry |
| Simple scripts | Start campaigns, health checks, low-end tips |
| Tier | RAM | Expected Experience |
|---|---|---|
| Minimum | 6–8 GB | Core lab + light campaigns |
| Recommended | 8–12 GB | Comfortable Wazuh + Suricata + campaigns |
| Better | 12 GB+ | Smoother indexing and longer retention |
Tested goal: Useful on older laptops and low-end PCs that cannot run heavy multi-VM labs.
- Linux (Ubuntu 22.04/24.04 recommended), WSL2, or macOS
- Docker + Docker Compose v2
- At least 6–8 GB free RAM
- 30+ GB free disk
Important (Linux): Increase vm.max_map_count (required by Wazuh indexer):
sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.confgit clone https://github.com/YOUR-USERNAME/AetherSOC.git
cd AetherSOCgit clone https://github.com/wazuh/wazuh-docker.git -b v4.14.7
cd wazuh-docker/single-node
# Generate certificates
docker compose -f generate-indexer-certs.yml run --rm generator
# Start Wazuh (this is the core of the lab)
docker compose up -dWait 2–4 minutes. Access the dashboard:
- URL:
https://localhost - Default credentials:
admin/SecretPassword
(Change them immediately after first login)
From the AetherSOC root directory:
cd ../.. # back to AetherSOC root if you were inside wazuh-docker
docker compose up -dThis starts:
- DVWA (port 8080)
- OWASP Juice Shop (port 3000)
- Suricata (network monitoring)
- Campaign runner support
chmod +x scripts/*.sh
./scripts/start-campaign.sh red-harvestAvailable campaigns (see campaigns/ folder):
red-harvest– Initial access → discovery → credential access style activitysilent-ledger– Insider / data staging style activityghost-protocol– Longer dwell simulation
The campaign scripts generate realistic traffic and activity against the vulnerable targets so Wazuh and Suricata produce alerts you can investigate.
Most labs let you run a single Atomic test or Caldera operation once.
AetherSOC campaigns are timed sequences:
- Stage 1 – Reconnaissance / scanning noise
- Stage 2 – Initial access attempts against DVWA / Juice Shop
- Stage 3 – Discovery and post-exploitation style actions
- Stage 4 – Persistence / data staging simulation
Each stage has delays so the timeline feels like a real incident unfolding. You practice:
- Watching alerts appear over time
- Writing or tuning detections
- Building timelines
- Investigating like a real SOC analyst
Campaign scripts live in campaigns/ and are simple, auditable bash/Python so you can modify or extend them.
- Always set
vm.max_map_count=262144before starting Wazuh. - Close heavy browsers and other apps while the lab is running.
- If the indexer is slow, reduce Wazuh retention or stop Suricata temporarily.
- Prefer SSD storage.
- On very low RAM (6 GB), start only Wazuh + one target first, then add the rest.
Common fixes are documented in docs/troubleshooting.md.
AetherSOC/
├── README.md # This file
├── docker-compose.yml # Targets + Suricata + helpers
├── campaigns/ # Living Narrative Campaign definitions
├── scripts/ # start-campaign, health-check, etc.
├── docs/ # Extra documentation
├── suricata/ # Suricata config & rules notes
├── targets/ # Notes about vulnerable apps
└── LICENSE
- Start a campaign.
- Watch alerts in the Wazuh dashboard.
- Look at Suricata Eve logs.
- Write or improve a custom rule.
- Re-run the relevant campaign stage and verify the detection fires.
This closed loop is the main learning path of AetherSOC.
This lab is for educational and authorized training purposes only.
All attacks run against intentionally vulnerable containers inside your own isolated environment.
Never point these tools at systems you do not own or have explicit permission to test.
MIT License – free to use, modify, and share.
Created for the community of people learning SOC and cybersecurity on low-end computers and PCs.
LinkedIn: https://www.linkedin.com/in/sajin-t-s-1127b4346
If this lab helps you, a star on the repository is appreciated.
Search terms this project is optimized for:
low end computer SOC home lab • low end PC SOC lab • lightweight SOC home lab • low resource cybersecurity lab • free SOC lab for low-end machines • SOC lab for old laptop