Security operations center — detecting and handling attacks for a small company (lab)
A complete security monitoring chain — spot an attack, open a case, investigate — built from free tools for a fictional client.
The need
A network of hearing-aid centres (a fictional client from a school brief) wants to outsource its security monitoring while keeping costs down.
The idea
Most lab setups stop at the alert. The real value is what happens next: triage, investigation, evidence.
What I built
- Detection on the workstations and on the network, behind a firewall.
- Logs gathered in one place through an encrypted tunnel.
- A script I wrote that turns every serious alert into a case to investigate, automatically.
- Investigation tools for disks and memory, and a security report generated every day.
The result
- 6building blocks connected end to end
- 7:00daily security report, sent automatically
- 100 %open-source tools
- Labnever in production — stated plainly
The chain works in the lab, from detection to investigation. It stayed a lab: no operational metrics to show, and I would rather say so.
In pictures
What I learned
Open source was chosen for cost and control, and it has a price: integrations are scripted by hand and detection rules tuned one by one. A commercial suite would have done it in three clicks — and taught me three times less.
Technical details Stack, architecture and decisions — for technical readers
Stack
- Wazuh
- Suricata
- pfSense
- Logstash
- Elasticsearch
- ElastAlert
- TheHive
- Cortex
- AlienVault OTX
- Autopsy
- Volatility
- Python
How it works
- Individual project for the Master's in Cybersecurity at Sup de Vinci (2023–2024), fictional client AudioProthèse+; brief aligned with ISO/IEC 27001 and the GDPR.
- SIEM: Wazuh agents on workstations, shipped over VPN, Logstash → Elasticsearch pipeline, central dashboard.
- IDS/IPS: Suricata behind a pfSense firewall, ET Open and Snort GPLv2 rulesets, IP reputation feed from AlienVault OTX.
- SOAR: TheHive, linked to Wazuh by a Python script on its REST API that turns every Wazuh or Suricata alert above a severity threshold into a case; Cortex for enrichment.
- Forensics with Autopsy (disk) and Volatility (memory); a daily report generated and sent at 7:00.
Still missing
- Lab only — never in production
- No operational metrics