SOC Home Lab with Wazuh SIEM for security monitoring, SSH attack detection, and log analysis across Windows and Linux systems
This project demonstrates a hands-on SOC (Security Operations Center) lab where real-world attack scenarios were simulated and analyzed using Wazuh SIEM.
The focus of this lab is to detect and analyze SSH brute-force attacks, perform log analysis, and understand how alerts are generated and investigated across Windows and Linux systems.
Kali Linux (Attacker)
↓
SSH Brute Force Attack
↓
Windows / Linux Targets
↓
Wazuh Agent → Wazuh Server → Dashboard
| Technique | ID | Description |
|---|---|---|
| Brute Force | T1110 | Repeated login attempts using SSH |
| Valid Accounts | T1078 | Successful login after multiple failures |
• Simulated SSH login attempts from Kali Linux
• Generated multiple failed authentication logs
• Observed attack detection in Wazuh SIEM
- Multiple failed login attempts (Event ID 4625)
- Followed by a successful login (Event ID 4624)
- Indicates potential brute-force attack
• Detected repeated login failures
• Identified potential brute-force attack pattern
✔️ Built a SOC lab using Wazuh SIEM
✔️ Simulated SSH brute-force attacks
✔️ Detected authentication failures
✔️ Correlated logs to identify attack patterns
✔️ Performed alert investigation
This project simulates a real SOC scenario where an analyst monitors authentication logs to detect brute-force attacks and investigates suspicious login patterns.