Project

Wazuh SOC Project

A defensive SOC project built with Wazuh, pfSense, threat intelligence, active response, and Shuffle automation. The project helped me practice how alerts move from log collection to triage, enrichment, and response.

Status Completed

Type Blue Team Project

Focus SOC Monitoring

Overview

This page is a shorter project summary of the full Wazuh SOC blog post. I kept the main setup, the important tests, and the screenshots that show the lab working. The full blog post has the longer notes and step details.

Lab idea

This project was a small SOC style lab built for defensive security practice. The goal was to connect logs, alerts, threat intelligence, active response, and simple SOAR automation in one working lab instead of only reading about them.

SOC architecture diagram for the Wazuh lab — The lab architecture and how the main machines connected together.

Main setup

Wazuh was the main SIEM. Windows Server 2022 and Bodhi Linux were added as monitored endpoints, while pfSense sent firewall logs through remote syslog. Kali Linux was used as the attacker machine for safe testing inside the lab.

Wazuh services running in the terminal — Wazuh services running on the Ubuntu machine.

Windows Server Wazuh agent active — Windows Server 2022 added as an active Wazuh agent.

pfSense remote syslog configuration — pfSense sending firewall logs to Wazuh through remote syslog.

Threat intelligence

The lab used VirusTotal, AlienVault OTX, and MISP style IOC matching to add context to alerts. This made the alerts more useful because a file hash or IP address could be checked against an outside source or a known IOC list.

VirusTotal lookup alert in Wazuh — Wazuh checking a file hash with VirusTotal.

AlienVault OTX IOC match alert in Wazuh — An IOC match alert from the OTX test list.

Detection and active response

I tested the lab with SSH brute force, Windows account creation, and SQL injection traffic. Wazuh detected the activity and active response handled some cases, like blocking an attacker IP or disabling a suspicious Windows account.

Hydra SSH brute force test — SSH brute force test from Kali Linux.

iptables blocking the attacker IP — The attacker IP blocked using iptables after active response.

Windows account response alerts in Wazuh — Wazuh alerts from the Windows account creation response test.

Shuffle automation

Shuffle was used as the SOAR part of the lab. It received Wazuh alerts through a webhook, checked a file hash with VirusTotal, then sent an email alert when the workflow condition matched.

Shuffle workflow overview — The Shuffle workflow used to enrich Wazuh alerts.

Shuffle email alert — Email alert sent after the Shuffle workflow finished.

What I learned

The main lesson was that defensive work depends on clean setup and testing. If the log source, rule, webhook, or active response path is wrong, the lab does not behave as expected. It also showed me how useful automation can be when it is tested carefully before being trusted.