🔐 Hands-on SOC lab - 12 tools (OpenSearch, Suricata, Zeek, MISP, Caldera, Velociraptor + AI agents) via Docker Compose. MITRE ATT&CK v14. Free

SOC Lab Project - AWS, Elastic, TheHive, MISP, Cortex, Shuffle

A set of Windows tools designed for SOC labs and controlled test environments providing automated TLS key logging setup for web encrypted traffic analysis and enabling or disabling of 16 Windows Defender components (9 functional protection components and 7 services/drivers) to support malware research, detection engineering, and Blue Team training.

Enterprise Security Operations Lab featuring Active Directory, Windows Security Monitoring, Windows Event Forwarding (WEF), Microsoft Defender, Splunk SIEM, Threat Detection, Alerting, and SOC Use Cases.

Professional High-Concurrency Port Scanner & Vulnerability Auditor | Engineered for SOC & Wazuh SIEM Integration.

SOC monitoring lab built using Graylog, OpenSearch, and Ubuntu. Includes log ingestion, detection engineering, alerting, and dashboards.

Security operation center lab

ICMP Protocol Analysis Lab using Wireshark – A hands-on cybersecurity lab focused on capturing and analyzing ICMP Echo Request and Reply packets, interpreting protocol fields, and applying Wireshark filters for investigation.

Building a hands-on Home AD Lab and experimenting with SOC monitoring.

Your full Guideline on how to install, deploy and use the Wazuh SIEM tool for newbies.

SOC Lab: Brute Force Detection with Wazuh SIEM. Configured Windows/Linux endpoints to monitor RDP & SSH attacks. Simulated threats via Kali Linux, analyzed security events (PCI DSS, MITRE), and implemented logging hardening. Focused on Incident Response and security monitoring for Tier 1 Analyst.

A lightweight Home SOC Lab optimized for low-resource devices. Featuring Suricata IDS/IPS, Filebeat on Parrot OS (VM), and Elastic Stack on Docker/WSL2.

SOC Security Monitoring Lab using Splunk Enterprise, Sysmon, Windows Event Logs, Custom dashboards, SPL detections, and alerts.

Ubuntu 22.04 server hardening with CIS Benchmark Level 2, auditd, UFW, fail2ban, and SSH key authentication

Attack simulations with full SIEM analysis, Wireshark packet captures, and structured investigation reports - Nmap recon, RDP brute force, and more.

Conducted separate network-level and log-based attack simulations to analyze detection capabilities across different sources

JUMAL (Junior Malware Analyst) - AI-powered tool for malware triage

Active Directory + Splunk home lab for monitoring Windows authentication events, investigating failed logons, and validating SIEM visibility.

End-to-end attack detection lab using Wazuh SIEM, Sysmon, and Windows event log analysis with MITRE ATT&CK mapping.