Ziead Shab Kalieh

SOC Center Homelab (Detection, Monitoring & Digital Forensics)

Designed and implemented a SOC homelab within an EVE-NG virtual environment to simulate real-world detection, monitoring, and incident response scenarios. The lab integrates network segmentation, intrusion detection, and centralized log management to evaluate security visibility and response effectiveness through controlled attack simulations.

Tools & Technology Stack

• VMware Workstation and EVE-NG for virtualization and network emulation
• pfSense firewall for network segmentation, routing, and traffic monitoring (SPAN)
• Security Onion for IDS/NSM and deep traffic analysis (Suricata, Zeek, Wazuh, Kibana, Hunt)
• Splunk Enterprise SIEM with Universal Forwarder and Syslog integration
• Kali Linux for attack simulation
• Windows Server (Active Directory Domain Controller) and Windows endpoints

Key Results & Outcomes

• Improved threat detection time from not detected to under 2 seconds.
• Increased visibility by generating multiple correlated security alerts across the SOC stack.
• Validated early detection, centralized logging, and alert triage through integrated SOC workflows.

Future Enhancements

• Integration of XDR and SOAR for automated response
• Application of AI techniques to enhance detection accuracy
• Migration and scaling of the SOC lab using cloud platforms