SOC Cyberintelligence Lab
Cyber Defence / Detection Engineering
A containerized SOC environment combining network segmentation, intrusion detection, honeypots, active defence, and controlled attack simulation.
SOC Cyberintelligence Lab is a Docker-based cybersecurity environment designed to simulate the infrastructure of a medium-sized enterprise. The system combines segmented networks, perimeter and internal firewalls, intrusion detection, honeypots, secure gateways, internal services, and attacker machines for realistic blue-team and red-team exercises.
The main challenge was to create a realistic enterprise security environment capable of detecting, recording, and containing different attack techniques while preventing direct access from exposed services to sensitive internal systems.
The environment was implemented using Docker containers distributed across segmented virtual networks. Suricata monitors perimeter and DMZ traffic, while an Nginx API Gateway provides TLS termination, rate limiting, request filtering, and reputation-based routing. Cowrie and SMB honeypots collect attacker activity, while firewall rules and network segmentation restrict access to internal services.
A dynamic reputation system connects Suricata with the Nginx API Gateway. Suspicious IP addresses detected by Suricata are automatically added to a reputation map and redirected away from the legitimate application toward a controlled web honeypot.
The environment was validated through an authorized external attack simulation involving reconnaissance, service enumeration, web probing, weak-credential testing, SMB interaction, SSH attacks, and attempts to pivot toward internal networks.
As part of a five-member cybersecurity team, I contributed to the design, implementation, testing, and documentation of the SOC environment. My work included infrastructure validation, attack simulation, service enumeration, detection analysis, evidence collection, and the preparation of technical reports and operational command guides.
- Network Segmentation
- Suricata IDS
- Active Defence
- Cowrie SSH Honeypot
- SMB Honeypot
- Nginx API Gateway
- Dynamic IP Reputation
- Firewall & NAT Rules
- Attack Simulation
- Detection Evidence
Docker·Linux·Suricata·Nginx·Cowrie·PostgreSQL·Kali Linux·Nmap·Hydra·Samba·iptables·PlantUML
