Skip to content

v1.2.0 — Production-Ready SOC

Choose a tag to compare

View all tags
@ajokunu ajokunu released this 27 Feb 19:54
· 26 commits to main since this release
v1.2.0
07d9283

What's Changed

Consolidated production-ready release with full SOC stack operational.

Core Stack

  • Wazuh 4.14.3 — SIEM/XDR with Manager, Dashboard, and Agent DaemonSet
  • OpenCTI 6.9.5 — Threat intelligence with MITRE ATT&CK, AlienVault OTX, AbuseIPDB, VirusTotal
  • TheHive 5.4 + Cortex 3.1.8 — Incident response with automated analyzers
  • Prometheus + Grafana — Full observability with custom Wazuh dashboards
  • OpenSearch 2.19.1 — Shared search/index backend

MCP Servers

  • 3 custom MCP servers, 21 total tools for Claude Code integration
  • @matchbox/wazuh-mcp — 7 tools (alerts, agents, vulnerabilities, rules, decoders)
  • @matchbox/thehive-mcp — 8 tools (cases, observables, analyzers, alerts)
  • @matchbox/opencti-mcp — 6 tools (indicators, reports, attack patterns, enrichment)

Security & Compliance

  • 23 NetworkPolicy rules across 5 namespaces (default-deny + explicit allow)
  • TLS 1.2+ with ECDHE cipher suites on Traefik ingress
  • All images pinned, no :latest tags
  • Audited against ISO 27001:2022, NIST 800-53, OWASP Top 10 for LLMs

Infrastructure

  • Lima VM (VZ framework, Rosetta 2, 10GB RAM, 4 CPUs)
  • k3s with custom kubelet tuning
  • 5 isolated namespaces: shared, wazuh, thehive, opencti, monitoring
  • Traefik ingress with path-based routing under soc.homelab.local

Full Changelog: v1.1.0...v1.2.0

Assets 2
Loading