Lab
How the home SOC is built, and why.
I built this lab to learn Level 1 SOC work by doing it: collect logs, run real attack techniques, see what fires, and write detections for what the defaults miss. Everything runs on one MacBook Air with 16 GB of RAM, so the whole thing is two VMs in UTM on a host-only network. The victim is never exposed.
Attacks run on the Windows endpoint with Atomic Red Team. Sysmon and the Wazuh agent ship the telemetry to Wazuh on the Ubuntu VM. I triage the alerts here, in a console I built, with Claude drafting summaries that I accept, edit, or reject.
Architecture
Versions
- Hypervisor
- UTM 4.7.5 (Apple Silicon)
- SIEM VM
- Ubuntu 22.04.5 ARM64, Wazuh 4.14.8 (manager, indexer, dashboard)
- Endpoint VM
- Windows 11 Pro 26H2 ARM64 (build 26300.9457)
- Telemetry
- Sysmon 15.22 (ARM64) with olafhartong/sysmon-modular + a lab profile
- Agent
- Wazuh agent 4.14.8 (x86 under emulation; no native ARM64 build)
- Attacks
- Invoke-AtomicRedTeam 2.3.0
- Console
- Next.js 16, Drizzle, Supabase Postgres, Claude (server side)
The full build, including every problem I hit and how I fixed it, is in the repo's setup guide. Source on GitHub.