TalonSocLab

In Dev · Phase B

Latest: Phase A complete, detection engineering next.

Repo: github.com/ktalons/talonsoclab

A single coherent home SOC, built in four phases across a few machines on my home network. Each phase ships independently with its own folder, README, architecture diagram, and lessons-learned write-up. By the end it runs a small SOC end to end, from log ingest through detection engineering to threat intel.

Two planes Link to heading

TalonSocLab is the data plane: it collects, filters, and cites telemetry, then emits a structured intake artifact. It does not reason and it does not decide. CASA, my senior capstone, is the separate reasoning plane that consumes it — deterministic infrastructure below, agentic reasoning on top.

Milestones Link to heading

  • Phase 0 — Hardware and network Complete SOC host on Ubuntu and Docker, wired through the managed switch with a reserved address, Wazuh stack green.
  • Phase A — Foundation SOC stack Complete Wazuh in containers with agents enrolled and verified on three real endpoints: Windows with Sysmon, macOS, and the Ubuntu host. Suricata on the host NIC and a SOC Overview dashboard in git.
  • Phase B — Detection engineering In Dev Atomic Red Team tests, a Sigma rule pack, and a MITRE ATT&CK coverage map.
  • Phase C — AD attack and defense Planned A mini Active Directory lab, the top five attack chain, and a purple-team report.
  • Phase D — Honeynet and threat intel Planned T-Pot feeding OpenCTI, enriched through the AbuseIPDB and VirusTotal APIs.

Why Link to heading

This is my first home lab. I learn by building the thing instead of reading about it, so I’m standing up a small SOC end to end and keeping it public for anyone coming up behind me.

Follow along Link to heading