SOC---Splunk-Home-Lab - A Splunk-based SOC home lab built to gain hands-on

项目说明

Splunk SOC Home Lab
O

I built this Splunk SOC home lab to get hands-on experience with how a SIEM actually operates in a real SOC-style en. The goal wasn’t just to install Splunk and ingest logs, but to understand how SIEMs behave when you have to manage storage, services, data flow, and troubleshoot issues that come up in practice.

This lab focuses on defensi, SIEM operations, and incident in rather than offensi or red-team tooling.

What This Lab Includes

This lab consists of a Linux-based Splunk Enterprise SIEM and a Windows endpoint generating realistic security telemetry. It includes Windows Security Event Logs, System and Application logs, and Sysmon data. Logs are routed to dedicated indexes, and the en incorporates real-world troubleshooting and operational fixes.

The lab is designed to serve as a foundation for building detections, in incidents, and documenting SOC workflows.

Architecture Summary
Splunk SIEM Server

The SIEM runs on Ubuntu Server 22.04 LTS with Splunk Enterprise installed as the primary log ingestion and analysis platform. Splunk is managed using systemd and runs under a non-root service account. The disk was expanded and resized using LVM to support sustained log ingestion.

Splunk is configured to receive logs over TCP on port 9997, run persistently across reboots, separate security telemetry into dedicated indexes, and enforce proper disk usage thresholds to prevent search failures.

Windows Endpoint

The monitored endpoint runs Windows 10 and is configured to generate realistic security telemetry. Log sources include Windows Security, System, and Application logs, as well as Sysmon Operational logs.

Sysmon is installed to provide enhanced endpoint , and the Splunk Uni Forwarder is used to collect and forward logs to the SIEM. This endpoint generates authentication events, process activity, and system behavior suitable for detection and in practice.

Index Strategy

To keep data organized and in, logs are separated into dedicated indexes. Windows Security, System, and Application logs are stored in the windows index, while Sysmon telemetry is stored in the sysmon index. Splunk system indexes are used only for internal health and performance data. No security data is stored in the default main index.

Key Skills Demonstrated

This project demonstrates practical experience with Splunk Enterprise installation and configuration, Uni Forwarder deployment, forwarder connectivity troubleshooting, Linux disk expansion and L, systemd service management, running Splunk as a non-root service account, log ingestion , index hygiene, and SOC-style troubleshooting and .

Challenges Encountered and Resolved

While building this lab, I worked through several real-world issues. These included Splunk searches failing due to disk pressure, expanding the disk and resizing the Linux filesystem, fixing startup failures caused by root-owned Splunk installations, migrating Splunk to run correctly as a ser user, and persistent startup and o service health.

Working through these issues reinforced how important infrastructure stability and are in a SOC en.

Current State

The en is stable and fully operational. Logs are actively flowing from the Windows endpoint, indexing and searching are functioning normally, disk and service issues have been resolved, and are in place for safe rollback.

Planned Next Steps

Next steps for this lab include building and documenting SOC detections, performing incident in and writing reports, mapping activity to MITRE ATT&CK techniques, creating dashboards and , and introducing controlled attack simulations to detections.

Troubleshooting and Lessons Learned
Sysmon Ingestion Issue

During setup, Windows event logs were successfully ingesting into Splunk, but Sysmon events were not appearing, e Sysmon was installed and generating logs locally on the Windows endpoint.

Windows Security, System, and Application logs were searchable, but the sysmon index remained empty. Inputs appeared to be configured correctly, and Sysmon activity was locally, which made the issue non-obvious.

After the Sysmon service, local event generation, forwarder connectivity, and input configuration, the root cause was identified as a service permission issue. The Splunk Uni Forwarder was not running with sufficient pri to read the Sysmon Operational event log, which is a protected Windows event channel.

The issue was resolved by changing the SplunkForwarder service to run under the Local System account. Once the service was restarted, Sysmon events immediately began ingesting into Splunk and became searchable in the sysmon index.

项目信息

开发语言：未知

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Splunk-based SOC home lab built to gain hands-on experience with real-world SIEM operations, log ingestion, and troubleshooting. Focused on defensive security using Windows Event Logs and Sysmon telemetry.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。