This project documents my beginner SOC home lab using Wazuh, Ubuntu Server, Docker, and Kali Linux. The purpose of the lab is to gain hands-on experience with security monitoring, log visibility, and alert investigation in a controlled environment. This lab also served as the foundation for a follow-up detection project involving attacker simulation and Wazuh alert analysis.
I built this project to better understand how security analysts monitor systems and investigate activity using a SIEM platform.
- Server: Ubuntu Server running Wazuh in Docker
- Testing Machine: Kali Linux
- Endpoint: Ubuntu system
- Workstation: Lenovo ThinkPad T14
- Wazuh
- Docker
- Ubuntu Server
- Kali Linux
- Nmap
- Wireshark
- Linux CLI
- Deploy Wazuh in Docker on Ubuntu Server
- Verify services and dashboard access
- Connect lab systems for monitoring
- Generate test activity in the environment
- Review logs and alerts in the Wazuh dashboard
- Document the setup and lessons learned
- Built a functioning beginner SOC lab
- Practiced using Wazuh for monitoring and visibility
- Improved Linux and Docker troubleshooting skills
- Gained experience documenting a cybersecurity lab project
- SIEM fundamentals
- Linux administration
- Docker basics
- Security monitoring
- Technical documentation
This project showed me that security monitoring depends on proper setup, endpoint visibility, and careful documentation. It also helped me better understand how blue-team workflows connect system activity to alerts and investigation.
- Add more endpoints
- Test additional alert scenarios
- Expand log analysis
- Integrate more blue-team workflows
Shows the Ubuntu endpoint registered and monitored by Wazuh.
Overview of alerts and security events detected in the environment.
Initial alerts and authentication activity generated during testing.
Expanded alert activity after additional lab activity was generated.
This SOC lab environment was later used to perform a follow-up security detection exercise involving reconnaissance, SSH access attempts, and Wazuh alert investigation.
SOC Detection Lab: Nmap Scan and Wazuh Alert Investigation
https://github.com/Lenox2Linux/soc-detect-nmap-wazuh
This follow-up project demonstrates how the lab environment can be used not only for setup and monitoring, but also for simulating activity and reviewing detection results through the Wazuh dashboard.