A hands-on Security Operations Center (SOC) home lab built using the Elastic Stack to securely collect, centralize, and investigate telemetry from Linux and Windows systems.
This project demonstrates the deployment of a centralized logging environment using Elasticsearch and Kibana. Telemetry is collected from a Linux web server running Nginx and a Dockerized OWASP Juice Shop application using Filebeat, and from a Windows endpoint using Sysmon and Winlogbeat. Communication between the Beats agents and Elasticsearch is secured using HTTPS/TLS, while Role-Based Access Control (RBAC) is implemented through dedicated service accounts.
The logging pipeline was validated using Atomic Red Team by executing the MITRE ATT&CK technique T1059.001 – PowerShell, confirming successful telemetry collection and investigation through Kibana.
- Elasticsearch
- Kibana
- Filebeat
- Winlogbeat
- Sysmon
- Atomic Red Team
- Nginx
- Docker
- OWASP Juice Shop
- VMware Workstation
- Centralized Logging
- SIEM Deployment
- Linux & Windows Log Collection
- HTTPS/TLS Configuration
- Role-Based Access Control (RBAC)
- Endpoint Telemetry
- Security Event Investigation
- MITRE ATT&CK Validation
Detailed project documentation is available here:
📄 SOC Home Lab v1.1 Technical Documentation
Note: This project focuses on building and validating a secure centralized logging pipeline using Elasticsearch, Kibana, Filebeat, and Winlogbeat. Logstash was intentionally omitted in v1.1, as the project scope did not require log parsing or enrichment. Future versions may incorporate Logstash as the lab evolves.
Author: Soham Helekar