This repository showcases a Security Operations Center (SOC) Lab designed to simulate a real-world enterprise security monitoring environment. The lab replicates how security teams collect, analyze, and respond to threats using centralized logging, SIEM solutions, and intrusion detection systems.
The setup consists of multiple systems including endpoints (Windows/Linux), a SIEM server, and an attacker machine, enabling realistic generation and analysis of security events. Logs from different sources are aggregated and processed to identify suspicious activities and trigger alerts.
The lab includes simulation of common attack scenarios such as:
- 🔍 Network reconnaissance (Nmap scans)
- 🔐 Brute-force authentication attacks
- 🚫 Unauthorized access attempts
- ⚙️ Suspicious process execution
These activities demonstrate how attacks are reflected in logs and how they can be detected through correlation rules and monitoring dashboards.
This project focuses on building practical skills in:
- 📊 Security event monitoring
- 🧾 Log analysis and correlation
- 🚨 Threat detection and alerting
- 🔎 Incident investigation and response
Overall, this SOC Lab provides hands-on exposure to blue team operations and helps in understanding how modern SOC environments function in detecting and mitigating cyber threats.