SOC Lab

I built this lab because most of the audit and compliance work I'd done up to that point looked at security controls from the outside reviewing policies, checking whether a control existed on paper. I wanted to understand what's actually happening on the other side of those controls, so I set up a small virtual network and ran it the way a real SOC would: generating traffic, collecting logs centrally, writing detection rules, and triaging whatever alerts came out of them.

The lab simulates a small enterprise environment a domain controller, a couple of Windows and Linux endpoints, and a perimeter being watched by a single analyst (me). Everything from initial setup to the final incident write-ups was done solo, over several weeks of evenings and weekends.

• Stand up a virtual network with endpoints, a domain controller, and internet-facing services to generate realistic traffic and logs.
• Centralize log collection into a SIEM and build detection rules for common attack patterns.
• Practice triaging alerts separating true positives from noise and escalating appropriately.
• Document each simulated incident with root cause, impact, and remediation steps.
• Map monitoring activity back to ISO 27001 Annex A.8 (Asset Management / Technological Controls) to connect hands-on work with a formal control framework.

• Wazuh SIEM for centralized log collection and monitoring
• VirtualBox hosting Windows and Linux virtual machines
• Windows Event Logs, Sysmon, Linux Syslog, and firewall logs
• Kali Linux and Sigma rules for attack simulation and detection validation

The lab was built in multiple phases. I deployed a Windows Active Directory environment with Windows and Linux endpoints, configured centralized log collection using Wazuh, enabled Sysmon and additional telemetry, created and tuned detection rules, simulated attacks from Kali Linux, and investigated each alert from detection through incident documentation.

• Built detection rules covering authentication abuse, PowerShell activity, persistence, and privilege escalation.
• Produced incident reports documenting timelines, indicators of compromise, root cause, and remediation.
• Created monitoring dashboards for endpoint visibility and alert triage.

This project strengthened my understanding of security operations by connecting governance and compliance with hands-on monitoring, detection engineering, and incident response. It improved my ability to investigate alerts, validate security controls, and relate technical evidence to ISO 27001 requirements.