SOC Lab: Wazuh, Sysmon & Zeek Telemetry Integration

Objective

The goal of this project was to build an isolated security-operations lab that centralizes endpoint and network telemetry for repeatable detection and investigation exercises. The validated scope covers segmented infrastructure, Active Directory, Wazuh agent enrollment, Sysmon event ingestion, Zeek JSON ingestion, and executed Atomic Red Team simulations with review of resulting endpoint/SIEM telemetry and detection behavior. Automated response and detection-rule tuning remain future work.

Architecture & Tech Stack

• Hypervisor: VMware Workstation Pro 17
• SOC Node (Defense): Ubuntu Server 24.04 LTS (Wazuh SIEM/XDR)
• Identity Provider: Windows Server 2022 (DC01: LAB.local Domain)
• Victim Node (Attack): Windows 11 Enterprise (WIN11-VIC01: Domain Joined)
• Attacker Node: Kali Linux (Adversary Simulation)
• Network Telemetry: Zeek 6.0 (LTS)
• Security Tooling: Sysmon (Olaf Hartong Config), Atomic Red Team
• Perimeter Gateway: Physical perimeter gateway providing management-side network telemetry

Phase 1: Dual-Homed Networking & Isolation

I implemented a dual-homed networking strategy to separate management access from the host-only test segment. The design keeps lab targets off the public internet while allowing the SOC server to receive management-side telemetry and serve the local dashboard.

Network Segmentation

• Management & Ingestion (VMnet0/Bridged): The SOC Server (ens33) resides on the management network. This allows Syslog ingestion from the perimeter gateway and dashboard access from the host.
• Internal Lab Wire (VMnet2/Host-Only): All lab nodes communicate over an isolated 10.0.0.0/24 subnet. There is no gateway to the internet from this segment. The SOC Server (ens37) acts as the bridge at 10.0.0.2.

Phase 2: Node Provisioning & Hardening

SOC Server (Ubuntu 24.04)

• Hardening: Disabled SSH service; management is restricted to the hypervisor console and HTTPS dashboard.
• Resource Allocation: 8GB RAM and 4 vCPUs. Static IP enforced via Netplan to prevent DHCP drift.

Domain Controller (DC01)

• Role: Configured as the Primary Domain Controller and DNS server for LAB.local (10.0.0.10).
• Hardening: External DNS resolution disabled to maintain environment isolation.

Victim Endpoint (WIN11-VIC01)

• Deployment: Integrated vTPM for localized VM encryption. Successfully joined to the LAB.local domain.
• Controlled Test State: Endpoint protections were temporarily adjusted inside the isolated disposable VM to model a post-compromise investigation state. This is not a recommended configuration outside the lab.

Phase 3: Wazuh Deployment

Troubleshooting LVM Disk Exhaustion

The initial deployment failed due to the Ubuntu installer provisioning only 19GB of the 40GB virtual disk. I performed an online volume expansion to reclaim the space:

lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
resize2fs /dev/ubuntu-vg/ubuntu-lv

Phase 4: Endpoint Integration (The “Python Bridge”)

Because the lab nodes lack internet access, I implemented a “Python Bridge” strategy for deployment.

1. Staging: Downloaded agents and tools to the SOC Server via the bridged interface.
2. Serving: Hosted files on the internal 10.0.0.2 interface using a Python HTTP server.
3. Enrollment: Agents were hard-coded to report to 10.0.0.2 over port 1514. Verified DC01 and WIN11-VIC01 as active in the dashboard.

Phase 5: Telemetry Enrichment (Sysmon Integration)

To add endpoint visibility, I deployed Microsoft Sysmon to both the domain controller and victim node using the Olaf Hartong (Sysmon-Modular) configuration.

• Ingestion: Modified the Windows agent ossec.conf on both nodes to monitor the Microsoft-Windows-Sysmon/Operational event channel.
• Validation: Confirmed Event ID 1 (Process Creation) and Event ID 3 (Network Connection) are successfully populating in the Wazuh ‘Discover’ tab.

Phase 6: Network Telemetry Integration (Zeek)

To provide full-spectrum network visibility and align with industry-standard network analysis methodologies, I deployed Zeek 6.0 (LTS) to monitor the internal lab wire.

Deployment & Stability

• Environment: Resolved Python 3 conflicts on Ubuntu 24.04 by forcing the websockets>=12.0 package installation, ensuring zeekctl stability.
• Network Binding: Bound Zeek to the ens37 (10.0.0.2) interface.
• Virtualization Workaround: Modified the configuration with redef ignore_checksums = T; to prevent packet loss caused by VMware’s virtualized checksum offloading.

SIEM Ingestion & Parsing

• Ingestion: Configured Zeek for JSON output and integrated the logs into the Wazuh Manager ingestion pipeline.
• Parsing validation: Created a custom JSON decoder/rule to verify that raw Zeek connection records were parsed and visible alongside endpoint telemetry. This validated ingestion; it was not treated as a production-ready detection rule.

Phase 7: Adversary Simulation & Detection Review

Kali Linux Attacker Node

• Networking: Assigned static IP 10.0.0.50 on the internal segment.
• Role: Provides a controlled source for adversary-emulation traffic inside the host-only segment.

Atomic Red Team Validation

• Framework: Used Invoke-AtomicRedTeam on the victim node inside the isolated lab.
• Execution: Executed Atomic Red Team simulations to generate controlled adversary activity.
• Review: Reviewed resulting endpoint/SIEM telemetry and detection behavior to assess visibility and investigative context.
• Limitation: Detection-rule tuning and automated response were not completed as part of this work and remain future validation areas.

Summary

This project established a controlled foundation for SOC investigations by combining Active Directory, Wazuh, Sysmon, and Zeek in a segmented virtual environment. The completed evidence demonstrates infrastructure deployment, agent enrollment, event ingestion, troubleshooting, and controlled Atomic Red Team execution with review of resulting telemetry and detection behavior. Detection-rule tuning and automated response remain future work.