CE Security Monitoring

Cybersecurity Home Lab

Wazuh SIEM & Enterprise-Style SOC Environment

A self-built cybersecurity lab used to generate realistic security events, monitor endpoints, analyze alerts, document investigations, and practice SOC analyst workflows.

View Case Files Download Sample IR

Lab Overview

Security Operations Lab Summary

Wazuh

SIEM Platform

4+

Virtual Machines

Linux

Primary Endpoint Focus

MITRE

Detection Mapping

Architecture

Lab Network Design

Network Layout

The current lab uses VirtualBox networking to separate internet access from the internal host-only lab network. Kali Linux is used as the attacker system, while Ubuntu and vulnerable lab machines generate logs and security events that are monitored by Wazuh.

This design allows safe attack simulation, endpoint monitoring, alert investigation, and incident documentation without exposing intentionally vulnerable systems to the public internet.

Current Lab Environment

The active environment includes a Wazuh Manager, Kali Linux attack workstation, monitored Ubuntu endpoint, and Metasploitable2 target. The systems communicate through an isolated VirtualBox host-only network while selected machines use NAT when internet access is required.

Current Network: VirtualBox Host-Only Current Subnet: 192.168.56.0/24 Monitoring: Wazuh SIEM Attack Platform: Kali Linux

Network Architecture

CE Security Home Lab Network Diagram

This diagram presents the planned architecture for the CE Security home lab, including network segmentation, centralized monitoring, virtualized security systems, and future expansion.

CE Security home lab network diagram showing a firewall, managed switch, Wazuh monitoring, management network, lab network, DMZ, IoT network, and guest network
CE Security Target Architecture

The active virtual lab currently operates on the isolated 192.168.56.0/24 VirtualBox host-only network. The pfSense firewall, managed switch, VLANs, DMZ, IoT segment, guest network, reverse proxy, and additional servers shown in the diagram represent the planned expansion of the environment.

Select the diagram to open the full-size image.

Systems

Virtual Machine Inventory

SIEM-01 Active

Wazuh Manager

Central monitoring platform used to collect endpoint events, display alerts, map activity to MITRE ATT&CK, and support SOC-style investigations.

Role: SIEM / Security Monitoring Focus: Alerts, agents, rules, and dashboards
ATTACK-01 Active

Kali Linux

Attacker workstation used to generate realistic events such as SSH failures, reconnaissance activity, exploitation attempts, and network traffic for investigation.

Tools: Nmap, Metasploit, SSH, and Linux CLI Focus: Attack simulation and detection validation
ENDPOINT-01 Active

Ubuntu Target

Monitored Linux endpoint used for authentication events, account changes, privilege-escalation testing, SSH monitoring, and Wazuh alert generation.

Role: Monitored Linux endpoint Focus: Authentication logs, sudo activity, and user changes
VULN-01 Lab Only

Metasploitable2

Intentionally vulnerable machine used to study attacker behavior, reconnaissance, exploitation paths, and future detection-engineering opportunities.

Tools: Vulnerable services and service enumeration Focus: Exploitation and detection opportunities

Workflow

SOC Investigation Process

Attack Simulation

Security events are generated from controlled lab activity such as failed SSH logins, privilege-escalation testing, account changes, reconnaissance, and vulnerable-service exploitation.

Detection and Alert Review

Wazuh alerts are reviewed to identify the affected endpoint, source IP address, rule level, MITRE tactic, event details, and supporting log evidence.

Incident Documentation

Findings are documented in professional incident reports containing an executive summary, event timeline, indicators of compromise, MITRE mapping, response actions, and lessons learned.

Portfolio Case Files

Completed investigations are converted into portfolio case files to demonstrate hands-on SOC skills, technical analysis, and professional security-documentation ability.

Coverage

Monitoring and Detection Focus

Authentication Monitoring Failed Login Detection Privilege Escalation User Account Changes SSH Brute Force Linux Authentication Logs Wazuh Rules MITRE ATT&CK IOC Identification Endpoint Monitoring Network Reconnaissance Incident Response

Roadmap

Planned Lab Expansion

Suricata IDS

Add network-based detection to monitor suspicious traffic, exploit attempts, scanning activity, and possible command-and-control behavior.

Windows Endpoint Monitoring

Add Windows event logs and Sysmon data to investigate PowerShell activity, process creation, persistence, lateral movement, and endpoint-compromise indicators.

Custom Detection Rules

Build custom Wazuh rules and detection logic for brute-force attacks, suspicious commands, privilege escalation, and malware-style behavior.

Threat Hunting Reports

Create structured threat-hunting write-ups based on hypotheses, evidence, log queries, findings, and recommended security improvements.

pfSense Firewall

Deploy pfSense to provide firewall policy enforcement, routing, network-address translation, VPN access, and traffic control between lab network segments.

VLAN Segmentation

Separate management, security-lab, DMZ, IoT, and guest systems into dedicated VLANs to practice segmentation and least-privilege network access.