Security-Operations-Center - A hands-on SOC simulation environment built with W

项目说明

Academic SOC — Open-Source Security Operations Center

A fully containerized, end-to-end Security Operations Center built as a 4th-year
cybersecurity engineering capstone. It chains open-source tooling into a complete
detection → response → threat-intelligence → pipeline and ships
with fi detection rules, automated incident-case creation, automated
threat-intel enrichment, a li, and fi attack
simulations.

---

What it does

| Capability | Implementation |
| --- | --- |
| Detection | 5 custom Wazuh rules (SSH brute force, sudo pri escalation, recon tooling, file-integrity tampering, web scanning), each mapped to MITRE ATT&CK |
| Response | A Wazuh integration auto-creates a TheHive case for every SOC alert, attaching the source IP as an observable |
| Threat Intel | An analyst runs Cortex analyzers ( + AbuseIPDB) on the case's obser in one click |
| | A pro Grafana dashboard: alert , top rules, agent status, MITRE tactic breakdown, li feed |
| | 5 single-command attack simulations + a jury demo runner, each the alert fired and the case opened |

---

The stack

| Service | Role | Image | URL |
| --- | --- | --- | --- |
| Wazuh Manager | SIEM engine (agents, API, analysis) | wazuh/wazuh-manager:4.7.4 | — (API :55000) |
| Wazuh Indexer | OpenSearch alert storage | wazuh/wazuh-indexer:4.7.4 | :9200 |
| Wazuh Dashboard | Alert exploration UI | wazuh/wazuh-dashboard:4.7.4 | |
| TheHive | Incident / case management | strangebee/thehive:5.2 | |
| Cortex | Observable analysis (analyzers) | thehi/cortex:3.1.7 | |
| Elasticsearch | Backend for Cortex only (internal) | elasticsearch:7.17.15 | — |
| Grafana | SOC dashboards | grafana/grafana:10.4.2 | |
| linux-agent-1 / 2 | Monitored endpoints (attack targets) | built from ubuntu:22.04 | SSH :2221 / :2222 |

All services share one Docker bridge network (soc-network) and persist to named .

---

Bring it up — one command

Prerequisites: Docker Engine 20.10+, Docker Compose v2, ~8 GB RAM free, and
=262144 (the script raises it if it can).

./start.sh starts the stack, waits for every service, bootstraps the TheHive and
Cortex organisations/users/keys, wires the Wazuh→TheHive case integration, enables
the + AbuseIPDB analyzers from .env, and prints the access URLs. First
run pulls images and builds the agents (10–15 min); it is idempotent and safe to
re-run.

Run the li demo

Each scenario launches an attack, then the expected Wazuh rule fired
and the TheHive case opened.

---

Access & credentials

| UI | URL | Login |
| --- | --- | --- |
| Grafana (SOC dashboard) | | admin / GRAFANA_PASSWORD → folder SOC |
| TheHi) | | wazuh / SocLab_TheHi! (SOC analyst) |
| Cortex (analyzers) | | admin / SocLab_Cortex2026! |
| Wazuh Dashboard | | admin / INDEXER_PASSWORD |

> Passwords come from infrastructure/.env. The SocLab_* above are the
> lab defaults set during bootstrap — change them for anything beyond the lab.
> TheHive also has the built-in super-admin admin / secret
> (in the admin org; it cannot see SOC cases).

---

Repository layout

---

Documentation

docs/technical_report.md — architecture, every rule

explained, the integration walkthrough, dashboard design, results, lessons learned.

docs/runbooks/ — analyst runbooks: triage, TheHive

in, Cortex interpretation, escalation, and remediation, per scenario.

docs/mitre_mapping.md — the rule-to-ATT&CK mapping.

infrastructure/README-SETUP.md — manual,

step-by-step bring-up if you prefer not to use start.sh.

---

Teardown

> ⚠️ This is a lab. It runs with self-signed certificates, default-ish
> credentials, an unauthenticated demo posture (e.g. Cortex CSRF disabled for
> headless bootstrap), and deliberately agents. Do not expose it to a
> network or reuse its configuration in production.

项目信息

开发语言：Shell

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A hands-on SOC simulation environment built with Wazuh, TheHive, Cortex and Grafana. Covers threat detection, incident management, automated threat intelligence enrichment and real-time dashboarding across 5 attack scenarios mapped to MITRE ATT&CK.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。