Built and actively operating a Remote SOC Homelab designed to simulate real-world detection, response, and…
Malek A. — Cyber Security Engineer
Built and actively operating a Remote SOC Homelab designed to simulate real-world detection, response, and security engineering challenges.
This isn’t a static lab — it’s a controlled environment where I design detections, validate assumptions, and test failure scenarios under realistic constraints (remote access, bandwidth limitations, segmented services).
🔧 Core stack:
Wazuh (SIEM & detection engine)
MISP (threat intelligence platform)
Graylog (log ingestion & pipelines)
DFIR-IRIS (incident response workflows)
FortiGate VM (network control, NAT, ACLs)
Pi-hole (DNS filtering & telemetry)
WireGuard (secure remote access across networks & devices)
🧠 Detection engineering focus:
🔹 Post-termination access abuse (O365 use case)
Simulated delayed offboarding scenarios and built custom detection rules to identify:
Unauthorized access after account lifecycle changes
Suspicious login patterns and persistence attempts
Behavioral anomalies tied to identity misuse
🔹 SMB abuse & data exfiltration detection
Designed rules and pipelines to detect:
Abnormal SMB traffic patterns
Large or unusual file transfers
Lateral movement indicators and data staging behavior
🔹 Threat intelligence integration
MISP enrichment into detection workflows
Correlation between known indicators and live events
🔐 Infrastructure & access design:
Secure remote SOC access via WireGuard (split tunneling)
Performance tuning (MTU optimization over mobile/5G networks)
Multi-host environment with centralized visibility
🚀 What makes this project valuable to me:
It’s a space where I can break things, simulate real incidents, and improve detection logic — not just deploy tools.
Next steps:
Real-time cyber threat visualization (Crucix-style, powered by my own telemetry)
Honeypot integration for live attack data
Advanced correlation between identity, network, and endpoint events
Always interested in discussing detection strategies, SOC design, and real-world use cases.
7 reactions · 2 comments
Comments
Laurent H.: Thank you Malek ANNABI, this is a seriously solid setup, especially the focus on testing under real constraints.Curious if you’ve started experimenting with AI/LLMs in this lab for detection tuning, triage or enrichment ? Feels like this kind of environment is perfect for validating where AI actually adds value vs just noise.
Malek A.: Laurent Halimi Absolutely, i'm preparing an n8n workflow integrating local Ollama LLM/Agent for enrichment and triage as well as high level alerts remediation. my current limitations are kinda hardware related as i preferted to selfhost every aspect of this lab for financial reasons. Thank you for your comment, i will eventually add this to the stack and test it. I previously used Ollama for a "Ji