SIEM Virtual Environment

Explore the experimental
SOC Homelab
by monitoring live.

Cybersecurity project by Ryan Mendenhall

Check it out
Learn More of the Infrastructure

Wazuh SIEM
providing overwatch.

  • Centralized logging & detection with Wazuh agents. Custom detection rules and MITRE ATT&CK mapping in progress.

Kali Linux instance
playing the attacker.

  • Nmap recon → vsftpd exploit → credential access → lateral movement. Real attack chains using Kali + Metasploitable.

Windows Pro, AD Server
and more as the victim.

  • Active Directory lab with Domain Controller and workstation. Realistic enterprise environment for detection engineering.
PROJECT GOAL

What and why is this
project underway?

Ascendant.design is a completely virtual Security Operations Center (SOC) home lab designed to replicate authentic cyber attack and defense environments. Hosted on VirtualBox, the setup encompasses four virtual machines connected via a segregated internal network. The architecture includes a Windows 11 Pro workstation, a Kali Linux system for offensive operations, a Metasploitable target machine, and a Wazuh SIEM server. Every simulated attack is aligned with the MITRE ATT&CK framework and actively monitored for detection through Wazuh.

Get started
// WHAT is the project?

The SOC Homelab is a series of 8 virtual machines. 1 VM serves as the Wazuh manager for SIEM overwatch. 1 VM is a version of Kali Linux, serving as a simulated attacker. The remaining VM's are various forms of Windows and Linux devices, including a Windows 2022 Server Active Directory instance, Windows Pro, and more.

// WHY is this project here?

The SOC Homelab serves as a important tool for me to continue to learn more about red team & blue team dynamics in a cybersecurity environment. It also serves as evidence of cybersecurity experience for resume purposes.

// HOW can I interact with it?

The data provided below is a live look-in at the current data being filtered through various logs, including the SIEM status, the status of its agents, the status of any simulated attacks, and more.

MY SETUP

The project status.

  • Define Project Goal
  • Install VirtualBox
  • Create virtual machine environment
  • Setup Wazuh Dashboard
  • Assign Wazuh Agent
  • Create VM Host-based Network
  • Upload Screenshot of VirtualBox VM Setup
  • Upload Screenshots of VMs
  • Upload Screenshot of Wazuh Manager
  • Create lab architecture diagram
  • Document Project Overview
  • Upload Screenshot of Project Management Scope

The following is an overview of the current
virtual machine setup of the SOC Homelab: 

Wazuh Manager SIEM serving as
overwatch VM

Kali Linux
Simulated
Attacker VM

Windows 2022 Server Active Directory VM

Windows 11 Professional VM
as victim

Windows 11
Home VM
as victim

Ubuntu Linux Instance VM
as victim

Live look at the homelab.

0 %
Brands using affiliates
for promotion: 52%
0 %
Gen Z using AI
search daily: 44%
0 %
Shoppers using AI for
purchases: 36%
0
Save 23+ hours per
week managing
How we work

Core features.

By reducing operating costs for the entire product team, we can invest more in innovative design, resulting in a superior user experience.

Traffic Surge
0%
0 %
payroll accuracy
Discover

Identify and connect with high-impact partners tailored to your industry.

Data Track

Capture user behavior across mobile apps and web properties for precise attribution.

Payments

Ensure partners are paid accurately and on time, fostering trust and long-term loyalty.

Protect

Prevent malicious activity and ensure you only pay for high-quality, authentic results.

Engage

Maintain active communication and provide partners with the resources they need.

Monitor

Generate reports that help you to visualize trends and make informed, data-driven decisions.

This website stores cookies on your computer. Cookie Policy