Project Case Study

SOC Lab v2: Endpoint Monitoring

I added Linux and Windows endpoints to Wazuh, generated controlled events, and verified file integrity and failed-logon alerts.

View Version 1 Back to Projects

Lab documentation

v1: Foundation v2: Endpoint Monitoring Full SOC Report (PDF)

Core stack

Proxmox VE on a dedicated server
Wazuh manager, indexer, and dashboard
Ubuntu 14.04 / Metasploitable-style target as a Linux endpoint
Windows 10 Pro as a Windows endpoint
Kali Linux and vulnerable lab systems kept on a separate pentesting bridge
vmbr0 for management and home network access
vmbr1 for Wazuh SOC monitoring traffic
vmbr2 for isolated pentesting lab traffic

What I built

Added SOC-side network adapters to existing Ubuntu and Windows 10 VMs.
Kept pentesting traffic on vmbr2 while Wazuh agent traffic used vmbr1.
Assigned static SOC IP addresses to endpoints on the 10.10.10.0/24 network.
Installed and started the Wazuh agent on an Ubuntu endpoint.
Installed and started the Wazuh agent on a Windows 10 endpoint.
Verified both endpoints appeared in the Wazuh dashboard.
Generated a Linux file integrity event and confirmed it appeared in Wazuh.
Generated Windows failed logon events and confirmed they appeared in Wazuh.

Network design

vmbr0 carries management traffic, vmbr1 carries SOC monitoring, and vmbr2 carries pentesting traffic. Ubuntu and Windows endpoints connect to both lab bridges; separate bridges alone do not guarantee isolation if a host routes between them.

vmbr0: Proxmox management / home network

vmbr1: Wazuh SOC lab

vmbr2: Pentesting lab

Wazuh manager SOC IP: 10.10.10.10

Ubuntu:

  vmbr2 pentest IP: 192.168.56.20

  vmbr1 SOC IP:     10.10.10.20

Windows 10:

  vmbr2 pentest IP: 192.168.56.30

  vmbr1 SOC IP:     10.10.10.30

Issues I had to solve

I resolved dashboard access, legacy Linux service management, and Windows installation issues.

Recovered access to the Wazuh dashboard after resetting the forgotten dashboard password.
Configured Wazuh VM networking so the SOC-side interface used 10.10.10.10.
Added a temporary internet adapter to the Ubuntu VM so it could download the Wazuh agent.
Worked around the older Ubuntu target not using systemctl by using legacy service commands.
Verified the Ubuntu agent through the Wazuh dashboard and generated a file integrity event.
Fixed the Windows Wazuh MSI installation by reviewing the installer log and resolving MSI rollback folder issues.
Confirmed Windows 10 failed logon events appeared in Wazuh after correcting the dashboard time range.

Evidence

Proof snapshots

Network setup, endpoint status, and controlled detection events.

Proxmox network page showing vmbr0, vmbr1, and vmbr2 bridges for management, SOC, and pentesting traffic — Proxmox bridges separated into management, Wazuh SOC lab, and pentesting lab networks.

Proxmox snapshots showing rollback points before SOC version 2 expansion and testing — Snapshots created before expanding the SOC lab and installing agents.

Wazuh dashboard showing Ubuntu agent active with IP address 10.10.10.20 — Ubuntu endpoint active in Wazuh after agent installation.

Wazuh dashboard showing an Ubuntu file integrity event for /etc/soc-lab-test.conf — Linux file integrity event detected after modifying a test file under `/etc`.

Windows 10 PowerShell showing both 192.168.56.30 and 10.10.10.30 IP addresses and successful ping to Wazuh — Windows 10 connected to both the pentesting network and the Wazuh SOC network.

Wazuh endpoint inventory showing Windows active and Ubuntu disconnected at the time of capture — Windows endpoint active in Wazuh. Ubuntu was disconnected at the time of this screenshot; its earlier test is documented above.

Wazuh event table showing logon failure events for the Windows 10 endpoint — Wazuh rule triggered for Windows logon failure caused by a controlled bad password test.

Detection Results

Events confirmed in Wazuh

Ubuntu file integrity

Changed /etc/soc-lab-test.conf. Wazuh recorded an integrity checksum change: rule 550, level 7.

Windows failed logon

Generated a failed Windows logon. Wazuh recorded “Unknown user or bad password”: rule 60122, level 5.

Endpoint visibility

Confirmed both Linux and Windows endpoint telemetry reached the Wazuh dashboard.

Next Stage

What comes next

Controlled Kali activity

Generate controlled scans from Kali against lab targets and compare what appears in Wazuh.

Incident notes

Write short SOC-style incident notes for each test event, including source, target, alert, and response.

Detection tuning

Adjust Wazuh rules, monitored paths, and event views to make useful alerts easier to find.