Building a Home SOC with Open-Source Tools

A home security operations centre (SOC) lab is one of the best ways to learn detection. You need a laptop or small server with 16 GB of RAM and free software.

Lab components

• Wazuh single-node deployment as the SIEM.
• A Windows VM with Sysmon and the Wazuh agent.
• A Linux VM with auditd and the Wazuh agent.
• An attacker VM on an isolated network to generate test activity.

First detections to build

1. Failed then successful logins from the same source.
2. New local administrator created.
3. PowerShell with encoded commands.
4. File integrity changes in system directories.

Follow our SIEM with Wazuh pathway for step-by-step instructions.