Enterprise SOC Monitoring and Incident Response Lab Overview This project demonstrates the design and implementation of a Security Operations Center (SOC) home lab environment for security monitoring, threat detection, incident response, and vulnerability management. The objective of this lab is to simulate real-world cybersecurity operations by monitoring security events, investigating alerts, identifying vulnerabilities, and documenting remediation activities. The environment was built using industry-standard security tools to gain practical experience in security operations and incident handling workflows.

Objectives

• Monitor endpoint and system security events.
• Detect and investigate suspicious activities.
• Perform incident response and evidence collection.
• Conduct vulnerability assessments and track remediation efforts.
• Analyze network traffic for security anomalies.
• Maintain security documentation and operational reports.
• Gain hands-on experience with SIEM and security monitoring technologies.

Lab Architecture Components Component Purpose Windows 11 VM Target endpoint for monitoring Kali Linux Security testing and attack simulation Wazuh SIEM Log collection and alert monitoring Sysmon Endpoint activity monitoring Nessus Vulnerability assessment Nmap Network discovery and enumeration Wireshark Network traffic analysis

Security Monitoring Activities Endpoint Security Monitoring

• Collected Windows security logs using Sysmon.
• Monitored process creation events.
• Reviewed user authentication activities.
• Investigated unauthorized access attempts.
• Detected suspicious command execution. Alert Monitoring
• Reviewed security alerts generated by Wazuh.
• Investigated failed login attempts.
• Analyzed privilege escalation indicators.
• Monitored endpoint security events.
• Documented findings and response actions.

Incident Response Scenarios Scenario 1: Brute Force Login Attempt Detection

• Multiple failed authentication events detected.
• Security alerts generated by monitoring tools. Investigation
• Reviewed authentication logs.
• Identified source IP address.
• Analyzed login patterns and account activity. Response
• Escalated suspicious activity.
• Blocked malicious source.
• Recommended password reset and account review.
• Documented investigation findings.

Scenario 2: Suspicious PowerShell Activity Detection

• PowerShell execution detected through endpoint monitoring.
• High-severity alert generated. Investigation
• Examined command-line arguments.
• Reviewed process relationships.
• Checked for persistence indicators. Response
• Isolated affected endpoint.
• Collected forensic evidence.
• Documented security incident.
• Recommended remediation actions.

Scenario 3: Malware Simulation Detection

• Endpoint security alerts generated.
• Suspicious file activity identified. Investigation
• Reviewed file behavior.
• Analyzed affected processes.
• Collected relevant logs and evidence. Response
• Removed malicious artifacts.
• Performed system scans.
• Verified system integrity.
• Updated incident documentation.

Vulnerability Management Assessment Activities

• Conducted vulnerability scans using Nessus.
• Performed network discovery using Nmap.
• Identified exposed services and security weaknesses.
• Prioritized findings based on severity levels. Example Findings Vulnerability Severity Missing Security Updates High SMB Configuration Issues Medium Weak TLS Configuration Medium Unnecessary Open Ports Low Remediation Process

1. Identify vulnerabilities.
2. Assess risk and severity.
3. Track remediation status.
4. Verify fixes through rescanning.
5. Update security reports.

Network Security Analysis Using Wireshark, the following activities were analyzed:

• DNS traffic monitoring
• TCP handshake analysis
• HTTP and HTTPS traffic review
• Port scanning detection
• Network communication troubleshooting

Documentation and Reporting As part of this project, the following documentation was maintained:

• Incident reports
• Security investigation notes
• Vulnerability assessment reports
• Remediation tracking records
• Operational security reports
• Lab configuration documentation

Skills Demonstrated Security Operations

• Security Event Monitoring
• Alert Investigation
• Threat Detection
• Incident Escalation
• Security Documentation Incident Response
• Incident Identification
• Evidence Collection
• Log Analysis
• Root Cause Investigation
• Remediation Support Vulnerability Management
• Vulnerability Assessment
• Risk Analysis
• Remediation Tracking
• Security Reporting Networking
• TCP/IP
• DNS
• DHCP
• VPN
• Network Traffic Analysis System Administration
• Windows Administration
• Active Directory Fundamentals
• User Access Management
• Endpoint Security

Key Learning Outcomes

• Developed practical SOC analyst skills through hands-on monitoring and investigation activities.
• Gained experience working with SIEM and endpoint monitoring technologies.
• Improved understanding of incident response processes and security operations workflows.
• Enhanced vulnerability assessment and remediation tracking capabilities.
• Strengthened cybersecurity documentation and reporting skills.

Future Enhancements

• Integration with Suricata IDS/IPS.
• MITRE ATT&CK framework mapping.
• Automated alert triage workflows.
• Threat intelligence integration.
• Security dashboard development using Power BI.