This project demonstrates the complete setup of an enterprise-style Security Operations Center (SOC) using virtual machines to simulate both network and host monitoring systems.
It integrates Wazuh, Snortand Slack to form a unified detection and response environment, all documented step-by-step in the guide below.
This SOC lab project builds a centralized SIEM (Security Information and Event Management) system capable of monitoring hybrid infrastructure — including on-premises servers, endpoints, and cloud nodes.
The environment consists of multiple VMs running various operating systems:
- Kali Linux
- Ubuntu
- Windows 10
- Windows Server 2022
- Amazon Linux EC2 (Cloud Server)
Each endpoint forwards security logs to a Central SIEM Manager (Ubuntu) integrated with Wazuh Manager, Snort IDS for visualization and correlation.
| Component | Purpose |
|---|---|
| Wazuh Manager | Collects, analyzes, and correlates logs from all endpoints. |
| Snort IDS | Detects network-based threats using signature-based detection. |
| Tailscale VPN | Securely connects cloud and local machines within a private network. |
| Slack Integration | Sends real-time security alerts to a Slack channel. |
- Multi-OS Virtual Environment Setup – Configured six different VMs simulating enterprise endpoints.
- Promiscuous Mode Configuration – Enabled bridge-mode monitoring for complete packet capture.
- Snort Deployment – Installed and configured Snort for intrusion detection on the central manager.
- Wazuh Manager – Deployed the SIEM backend with visualization stack.
- Agent Installation on All Endpoints – Forwarded security logs from Windows, Linux, and cloud systems.
- AWS EC2 Integration – Linked Amazon Linux instance securely via Tailscale VPN.
- Detection Rules Creation – Defined custom Wazuh rules for SSH brute-force and authentication failures.
- Slack Automation – Integrated alerting workflow using Slack Webhooks for real-time incident response.
- Attack Simulation – Performed simulated brute-force and scanning attacks to validate rule functionality.
The complete setup guide with all commands, configuration files, and screenshots is available in the document below:
📘 Download the Full Guide (Enhanced DOCX)
This guide includes:
- Installation commands for each tool
- Configuration snippets
- Verification and troubleshooting notes
- Screenshot placeholders for clarity
- SIEM & IDS/IPS Deployment (Wazuh + Snort)
- Log Correlation and Incident Detection
- Network Traffic Monitoring (Promiscuous Mode)
- Alert Automation via Slack Webhook
- Cloud Security Integration (AWS EC2 + VPN)
- Linux Administration and Multi-OS Setup
Final Rating: 9/10 – Highly Impressive SOC Lab Project
“This project reflects hands-on experience with real SOC components. The hybrid setup, rule customization, and automation reflect readiness for Tier-1 SOC Analyst or Blue Team roles.”
-
Clone the repository:
git clone https://github.com/<your-username>/<your-repo-name>.git
-
Download and open the guide:
open soc_project_guide.docx
-
Follow the steps to recreate your own SOC Lab environment.
Fazal
Engineering in Computer Science – Specialized in Cyber Security
SR University
📫 Connect on LinkedIn: [https://fazalsec.me]
🌐 Portfolio: [https://fazal-portfolio-git-main-fazals-projects-01b6c4d5.vercel.app/]
SOC Wazuh Snort SIEM Network Security Incident Response Cybersecurity SOC Analyst Cloud Security Automation Blue Team
© 2025 Fazal – All rights reserved. This project is for educational and research purposes only.