Why Build a Home SOC Lab?
A home Security Operations Center lab provides:
Hardware Requirements
Minimum Specs
Recommended Setup
Software Stack
1. Virtualization Platform
Options:
2. SIEM Solution
3. Network Security Monitoring
4. Vulnerable Machines
Network Architecture
Internet
|
pfSense Router (Firewall)
|
Management VLAN (10.0.1.0/24)
├─ Proxmox Host
├─ Admin Workstation
|
Security Tools VLAN (10.0.10.0/24)
├─ SIEM Server
├─ IDS/IPS
├─ Log Collectors
|
Attack VLAN (10.0.20.0/24) [ISOLATED]
├─ Kali Linux
├─ Attacker Tools
|
Victim VLAN (10.0.30.0/24) [ISOLATED]
├─ Vulnerable VMs
├─ Windows Domain
├─ Web Servers
Step-by-Step Setup
Phase 1: Infrastructure (Week 1)
Install Proxmox on bare metal Configure networking and VLANs Setup pfSense VM as router Configure firewall rules
Phase 2: Security Tools (Week 2)
Deploy SIEM solution Install IDS/IPS (Suricata) Setup log collection agents Configure initial dashboards
Phase 3: Attack/Defend (Week 3)
Deploy vulnerable machines Setup Kali Linux attack box Create Windows domain Install honeypots
Phase 4: Testing & Tuning (Week 4)
Generate attack scenarios Tune detection rules Document investigations Create runbooks
Essential Tools List
Log Management:
Filebeat/Winlogbeat Syslog-ng NXLog
Network Analysis:
Wireshark tcpdump NetworkMiner
Threat Intelligence:
MISP OpenCTI Threat feeds
Automation:
TheHive (Case management) Shuffle (SOAR) Python scripts
Cost Breakdown
Budget Option (~$500):
Used Dell/HP workstation: $300 RAM upgrade (32GB): $100 SSD storage: $50 Managed switch: $50
Recommended Setup (~$1,500):
Mini PC (NUC/Beelink): $600 64GB RAM: $200 2TB NVMe SSD: $150 Enterprise managed switch: $200 UPS: $150 Raspberry Pi 4 (8GB): $100 Miscellaneous: $100
Learning Resources
**Books:** - "Applied Network Security Monitoring" by Sanders & Smith
- "Blue Team Handbook" by Don Murdoch
- "The Practice of Network Security Monitoring" by Richard Bejtlich
**Online Training:** - TryHackMe SOC Level 1 path
- LetsDefend.io
- Cybrary SOC Analyst courses
**Communities:** - r/blueteamsec
- SANS Blue Team Discord
- SOC Analysts Slack
Next Steps
Once your lab is running:
Work through detection scenarios Practice incident response Build your portfolio Document everything for job interviews
Want to test professional-grade tools in your lab? Contact us about our Early Adopter Program for NeuroSmash and Nerou SIEM.