Security Operations Home Lab
Overview
This project is a local security operations environment that I built on a Lenovo ThinkCentre M920q using VirtualBox. The lab covers SIEM operations, identity and access management, data loss prevention, vulnerability scanning, and infrastructure-as-code automation. Everything runs locally with no cloud billing involved, and the full setup is documented on GitHub with step-by-step guides.
I built this lab to get hands-on practice with tools and workflows that I’m studying through certifications and Udemy courses. Reading about detection rules and incident response is one thing, but actually deploying a SIEM, enrolling endpoints, writing custom rules, and then investigating the alerts that fire is where the real learning happens. This lab gives me the environment to do that repeatedly.
What the Lab Includes
The lab runs on a tiered VM model to work within 16 GB of RAM. Three VMs stay running at all times: the Wazuh SIEM server, a Windows 10 endpoint with Sysmon, and a Linux endpoint that handles data scanning and Python automation. The remaining VMs (Keycloak for IAM, an Active Directory domain controller, and a vulnerable target for scanning) swap in as needed.
Wazuh SIEM is the core of the lab. It collects logs from all endpoints, processes them through custom detection rules, and surfaces alerts through the Wazuh Dashboard. I wrote 12 custom detection rules that map to MITRE ATT&CK techniques covering brute force attacks, encoded PowerShell execution, privilege escalation via sudo, account creation on both Windows and Linux, file integrity changes to critical system files, and DLP findings from the data scanner.
Keycloak serves as the identity provider for the lab environment. I configured a dedicated security-lab realm with RBAC roles that map to a realistic SOC team structure: Tier 1 analysts, Tier 2 analysts, security engineers, IAM admins, and auditors. MFA is enforced through OTP, and I registered the Wazuh Dashboard as an OIDC client so analysts authenticate through Keycloak. The entire realm configuration is exported and version-controlled so the setup is reproducible.
Active Directory runs on a Windows Server 2022 domain controller. I set up a lab.local domain with organizational units, security groups, and Group Policy Objects for audit logging, password enforcement, and local admin restrictions. The Windows 10 endpoint is domain-joined, and the DC is monitored by Wazuh with detection rules specifically for AD events like account lockouts, privileged group changes, and GPO modifications.
OpenDLP and a custom Python data scanner handle data discovery and classification. I created scan profiles for PII, leaked credentials, and compliance-relevant patterns, and seeded the lab with synthetic test data to validate the detections. The scanner outputs findings in JSON format that the Wazuh agent ingests, so DLP findings appear as alerts alongside everything else in the dashboard.
Terraform codifies the VM provisioning as infrastructure-as-code. The modules handle VM creation, resource allocation, storage, and network configuration through VBoxManage commands, and a terraform destroy tears the entire lab down cleanly for a fresh rebuild.
Detection Rules and Investigation Workflows
The part of this lab I focused on the most is detection engineering. Each custom Wazuh rule has a documented test procedure that simulates the attack technique it detects. For example, the SSH brute force rule triggers after five failed login attempts from the same source IP within two minutes. The encoded PowerShell rule catches Base64-encoded commands and download execution patterns in Script Block logs. The privilege escalation rules flag sudo usage by non-standard users and sudo commands that spawn root shells.
Every rule maps to a specific MITRE ATT&CK technique ID, so the detections tie back to a recognized framework. The investigation walkthroughs document the full triage process for each scenario: what triggered the alert, what evidence I collected, how I traced the activity, and what the remediation steps would be.
Automation
The Python automation scripts serve three purposes. The data scanner (data_scanner.py) scans directories against configurable YAML profiles and outputs severity-rated findings. The alert analyzer (alert_analyzer.py) queries the Wazuh Indexer API to pull alerts filtered by severity, agent, or MITRE technique and generates triage summary reports. Both scripts are designed to integrate with the lab’s existing log pipeline rather than operate in isolation.
CI/CD Security Pipeline
The GitHub repository has a security pipeline that runs on every push and pull request. It validates Terraform configurations with tfsec and Checkov, lints Python scripts with flake8, runs Bandit for security scanning on the Python code, validates Wazuh rule XML syntax, and scans for leaked secrets with Gitleaks. This demonstrates how security checks integrate into a CI/CD workflow to catch misconfigurations before they reach production.
What I Learned
Building this lab reinforced concepts that are difficult to internalize through coursework alone. Configuring Wazuh’s rule hierarchy and understanding how rules chain together through if_sid references requires working with the system directly. The same applies to Keycloak’s realm configuration, Active Directory GPO inheritance, and Terraform state management. These are all things that make more sense after troubleshooting them firsthand.
The lab also serves as a reference environment for my SC-500 studies. The Keycloak RBAC roles, Conditional Access concepts, and PIM workflows in the Azure exercises all map to identity and access management domains on the exam. Having a working lab to test these configurations against makes the material more concrete.