Independent project · current

Cloud SOC Lab Builder

Automated deployment of a cloud SOC range for security training, attack/defence simulation, and detection-engineering practice. Compose and Terraform live in this repository.

Repository

Lab VPC

Isolated AWS-style network, flow logs, no inbound from internet except bastion.

planned

Wazuh SIEM

Agent telemetry, FIM, and MITRE-mapped rules for Windows/Linux endpoints.

planned

Suricata IDS

SPAN / VPC traffic mirror for C2, scan, and exploit-kit signatures.

planned

TheHive

Case management for blue-team writeups and evidence packing.

planned

n8n SOAR

Webhook → enrich IOC → Slack/email → open TheHive case.

planned

Attack range

Caldera-style adversary emulation against disposable lab assets only.

planned

Training scenarios

Cloud credential theft

Defence

IAM access key used from a new country. Students hunt CloudTrail, disable the key, and write the detection.

Phishing to foothold

Attack / Defence

Mailbox rule + OAuth consent on a lab tenant. Blue team reconstructs the mail flow and revokes grants.

Kubernetes noisy neighbor

Detection

Compromised pod starts scanning the cluster network. NetworkPolicy and kube-audit rules are the scoring criteria.

Apply log

> Range idle. Click deploy to bring the SOC stack online.

Terraform sketch

Source lives in this repo under labs/cloud-soc-lab-builder. It is a training range — not a production SOC.

module "soc_lab" {
  source = "./modules/soc-lab"

  name               = "fahad-soc-range"
  region             = "eu-west-2"
  enable_guardduty   = true
  enable_flow_logs   = true
  wazuh_instance     = "t3.large"
  allowed_cidrs      = ["lab-bastion/32"]
}

resource "aws_security_group" "siem" {
  name        = "soc-siem"
  description = "Wazuh and TheHive - lab only"
  vpc_id      = module.soc_lab.vpc_id

  ingress {
    description = "Analyst UI via bastion"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    security_groups = [module.soc_lab.bastion_sg]
  }
}