GitHub - Pat4rthur/sovereignMediaLabV2: SOC homelab environment demonstrating SIEM deployment, log analysis…
Patrick Arthur — On a mission to become a SOC Analyst; bringing hands-on SIEM, IR, and compliance chops, plus a genuine belief that good security is built with good people.
I've been building something in my spare time and I'd love some honest feedback from folks who live this stuff day to day.
It's an ongoing homelab; 10 nodes on Proxmox/LXC running a media stack, but the real point is the security layer. So far I've deployed Wazuh for SIEM, set up UFW microsegmentation on every container, rolled out a WireGuard VPN with least-privilege routing, written custom detection rules, and run through a full incident response simulation with a documented playbook. Most recently I hardened everything against CIS benchmarks and automated the compliance scanning. All the phases are documented on GitHub.
Next up: I'm planning to add cloud infrastructure to turn this into a hybrid environment and run incident response scenarios that span on-prem and cloud, the kind of thing an analyst would actually see in a real SOC. I also want to fold in some CASB-style detection and DNS exfiltration simulation.
If you work in SOC, detection engineering, GRC, or cloud security, I'd genuinely appreciate your take. What would you do differently? What's missing? What skills are actually showing up in your day-to-day that I should make sure I'm building here?
Repo: https://github.com/Pat4rthur/sovereignMediaLabV2
#homelab #cybersecurity #blueteam #SOCanalyst #infosec #cloudsecurity #continuouslearning
7 reactions · 7 comments
Topics: #continuouslearning, #blueteam, #cloudsecurity, #infosec, #socanalyst, #cybersecurity, #homelab
Comments
Adrien R.: Good starting point to become a very good cyber expert 👍 15 years ago I created a Secure self-hosted infrastructure project, just like you. Never stop, listen you first and request advice, exactly like you do. An advice to improve your system could be to install an IDS like Suricata and use Wazuh to ingest the alert so you can transform your system in XDR with corelation level between network and
Patrick Arthur: Ana Dem Oh wow! I have been looking for a way to work EDR/XDR into the stack, and the IDS is a no brainer! I appreciate your feed back so much, so thank you. These are going onto the top of the list of new integrations!
Haydn K.: I'm gonna take a look later, but in the meantime I followed you!
Ikechukwu O.: Love the detection engineering focus; maybe fold in MITRE ATT&CK mapping for your custom rules to show alignment with real-world adversary tactics. Again, you could also explore automated compliance checks with tools like OpenSCAP or integrate with CI/CD pipelines. I do not know if I saw this , but you might also explore layering IDS/IPS alongside the firewall for deeper packet inspection. BRILLIA
Patrick Arthur: Ikechukwu Justin Onyekwere I really appreciate it! I have been meaning to get some experience with OpenSCAP, so that is definitely getting added to the plan. I can't thank you enough for the feedback