Project: a home SOC lab
In short: A home SOC lab shows employers you can do the daily work of a junior analyst: collect logs, notice suspicious activity, triage alerts and explain them. You build an isolated lab with a SIEM and several log sources, simulate techniques safely, and write up what you detected.
Goal and requirements
The goal is not to collect tools but to produce evidence of analyst skills. A SOC (security operations centre) monitors systems, investigates alerts and responds. Your lab should let you do that end to end.
- Isolated: a separate network behind a lab firewall, as in the home lab project.
- Realistic sources: at least one Windows host, one Linux server and network logs.
- Repeatable tests: simulations you can re-run after changing a rule.
- Hardware: a machine with 32 GB RAM is comfortable; 16 GB works if you run fewer VMs at once.
Design
| Component | Example choice | Why |
|---|---|---|
| SIEM | Wazuh, or Elastic Security free tier | Rules, dashboards, agents |
| Windows telemetry | Sysmon with a community config, plus PowerShell logging | Process, network and script detail |
| Network | pfSense or OPNsense logs, Suricata IDS (intrusion detection system) | Traffic and alert view |
| Simulation | Atomic Red Team tests run on your own test VM | Known, mapped techniques |
| Case notes | A ticket template in Markdown or a free case tool | Shows your reasoning |
Warning: simulation tools produce real attack behaviour. Run them only on VMs you own, inside the isolated lab, after taking a snapshot. Never point them at other people's systems.
Build plan
- Build the SIEM, following the Wazuh lab.
- Add Sysmon to the Windows VM and enrol the agent; confirm process creation events arrive.
- Forward firewall logs by syslog; add Suricata on the firewall or a sensor VM.
- Pick five techniques from MITRE ATT&CK, such as brute force, a new local admin account, a scheduled task, encoded PowerShell and a port scan from inside.
- For each: snapshot, simulate, check the logs, write or tune a rule, re-test, then revert.
- Write a short triage note for each alert: what, when, which host, verdict and next steps.
Sysmon64.exe -accepteula -i sysmonconfig.xml
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10
Install-Module -Name invoke-atomicredteam -Scope CurrentUser
Invoke-AtomicTest T1053.005 -ShowDetails
Invoke-AtomicTest T1053.005 -CleanupUse -ShowDetails first to read exactly what a test will do before you run it, and always run the cleanup afterwards.
Deliverables and how to present it
- An architecture diagram and a data-source table showing which logs feed which detections.
- Five or more detection write-ups mapped to ATT&CK technique IDs, with screenshots and the rule logic.
- One incident-style report following a lifecycle such as NIST SP 800-61.
- A list of noisy rules you tuned and why: this shows judgement, not just installation.
On a CV: "Built a home SOC lab (Wazuh, Sysmon, Suricata) and developed five ATT&CK-mapped detections with triage playbooks." In interviews, walk through one alert from first signal to verdict. Hiring managers for junior SOC roles care most about how you think.
Practice
Why add Sysmon to Windows hosts in a SOC lab?
What makes a detection write-up valuable to an employer?
Why snapshot before running a simulation?
Key takeaways
- Aim for evidence of analyst skills, not a long list of tools.
- Combine endpoint, server and network log sources in one SIEM.
- Simulate ATT&CK techniques only on your own isolated VMs.
- Test, tune and re-test each detection, then document it.
- Present triage write-ups and tuned rules in your portfolio.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.