SOC Automation and Detection Engineering Homelab

The lab is organized into three operational planes:

• Data plane: pfSense, Squid Proxy, and Suricata enforce controlled egress, SSL inspection, and network detection coverage.
• Telemetry plane: Sysmon, Wazuh, remote syslog, and Splunk Universal Forwarder push endpoint and network evidence into Splunk.
• Response plane: n8n orchestrates VirusTotal, a local LLM triage step, DFIR-IRIS, Velociraptor, and Wazuh Active Response.

• Endpoint, proxy, firewall, and IDS telemetry is forwarded into Splunk.
• A Splunk correlation search sends a webhook payload into n8n.
• n8n creates or updates a case in DFIR-IRIS.
• The workflow enriches the alert with VirusTotal.
• A local LLM returns a deterministic HIGH_RISK or LOW_RISK triage decision.
• High-risk alerts trigger Velociraptor collection and Wazuh host isolation.
• Low-risk alerts are documented and closed with supporting context.

Two synthetic scenarios were used to validate the workflow safely:

• High-risk path: a simulated malicious IOC event designed to trigger escalation, enrichment, forensic collection, and containment.
• Low-risk path: a benign browser and gateway activity event designed to confirm safe closure behavior.

No real malware execution or uncontrolled external traffic was required for these tests.

Validation used synthetic JSON events only. No adversary technique was executed live on the wire.

Published test generators: scripts/highrisk.ps1, scripts/lowrisk.ps1. Architecture write-up: docs/architecture.md.

Summary grounded in the lab blueprint and screenshots. The original SPL saved searches, n8n workflow export, and Wazuh rule files are no longer available. Behaviour below matches docs/architecture.md and the evidence refs. Exact query syntax is not reproduced.

Enrichment source: VirusTotal v3 (confirmed in the June 2026 architecture blueprint and in the synthetic event payloads: threat_intel_source = "VirusTotal").

Footnote — Ref 10: The Ref 10 workflow screenshot shows an earlier Shuffle / MISP prototype (node labelled "MISP Threat Intel Lookup"). The production lab design documented in docs/architecture.md uses n8n with VirusTotal v3 enrichment. Treat Ref 10 as historical prototype evidence, not the final enrichment path.

1. Trigger (Splunk, Ref 6)

Synthetic events from scripts/highrisk.ps1 and scripts/lowrisk.ps1 are indexed in Splunk (written as JSON lines under C:\SOAR-Test\soar_vt_test.jsonl; no real IOC connections). A search builds a normalized alert. For the high-risk script the alert carries:

• alert title "VirusTotal Malicious IP Detected" / rule "VirusTotal Malicious IP Communication"
• severity high, risk level HIGH_RISK, SOAR alert type VT_HIGH_RISK_TRIGGER
• workflow action escalate_to_iris_and_collect_velociraptor
• IOC: documentation address 198.51.100.66 on port 443 (threat_intel_source = VirusTotal)

The low-risk script maps to benign browser/gateway activity and "No containment required… close as false positive or monitor only." Splunk sends the alert to n8n by webhook.

2. Case creation and enrichment (n8n and DFIR-IRIS, Refs 9-11)

In n8n, the alert is normalized, DFIR-IRIS opens a case, then a VirusTotal v3 lookup enriches the indicator (reputation / detection counts).

3. LLM verdict

The enriched alert is passed to a local model qwen/qwen3.5-9b (primary) via LM Studio or Ollama at temperature 0.1; Hermes3-8B and Gemma were also tested. The model must emit FINAL_DECISION: HIGH_RISK or FINAL_DECISION: LOW_RISK. An n8n switch branches on that verdict.

4. Response

• HIGH_RISK: Velociraptor runs Windows.Triage.Collection (Refs 12-14). n8n authenticates to the Wazuh Manager REST API (HTTPS port 55000) and triggers Active Response host isolation (e.g. firewall-drop / host-deny) (Ref 8). DFIR-IRIS records a timeline event.
• LOW_RISK: DFIR-IRIS is updated and the case is documented and closed (flow step 7).

Pseudo-flow

Synthetic JSONL event (highrisk.ps1 / payload-vt-low-risk.ps1)
  -> Splunk search builds normalized alert (severity, risk_level, workflow_action, VT fields)
  -> webhook -> n8n: Normalize Alert
  -> DFIR-IRIS: create case
  -> VirusTotal v3 enrichment
  -> Local LLM (temp 0.1): FINAL_DECISION HIGH_RISK | LOW_RISK
  -> if HIGH_RISK:
        Velociraptor Windows.Triage.Collection
        Wazuh Active Response host isolation
        DFIR-IRIS: add timeline event
     else:
        DFIR-IRIS: low-risk update, document and close