My Cybersecurity Home Lab Blueprint: Everything I Use for SOC Training
I built a complete home lab for SOC training on a MacBook Air and old Dell laptop. Cost: ₹0 (zero). Software: 100% free and open-source. Setup time: 2 weeks part-time.
This lab lets me:
- Deploy vulnerable VMs and attack them
- Monitor traffic with Wazuh
- Analyze logs with ELK stack
- Practice incident response workflows
- Test detection rules before deploying to Splunk at work
Most home lab guides cost money or require enterprise hardware. This one doesn't. This is what I actually run on hardware I already owned, using tools that scale from personal labs to enterprise SOCs.
Setting everything up inside VirtualBox took a bit of trial and error. My first few virtual machines were slow because I allocated too much RAM, but after adjusting the resources the lab became much smoother to use.
The Lab Architecture (High-Level)
Before deploying any virtual machines, I sketched a simple network layout so I knew where each system would fit. Having a basic architecture diagram made troubleshooting much easier later.
The Hardware I Used
Runs VirtualBox with 3-4 VMs simultaneously. Initially struggled with RAM limits, so I focus on one major VM + Wazuh server at a time. Works fine for learning; enterprise labs would need more capacity.
Used for dedicated Kali Linux instance when I need to run penetration testing tools without slowing down main lab. Also serves as a test endpoint for Wazuh monitoring.
🛠 Recommended Hardware Upgrades for Your Cybersecurity Home Lab
Although I built this home lab using free software, a few affordable hardware upgrades can make running virtual machines, SIEM tools, and penetration testing labs much smoother.
💽 External SSD (240GB/256GB)
Perfect for storing Kali Linux, virtual machines, Wazuh logs, Docker images, and backups without filling your main drive.
🛒 Check Price on Amazon🔌 SATA to USB Adapter
Useful for recovering files from old hard drives, analyzing disks during forensic practice, or cloning drives for lab experiments.
🛒 Check Price on Amazon🍓 Raspberry Pi Case + Power Supply
Great for building a portable SOC lab, Pi-hole DNS server, network monitoring appliance, or lightweight cybersecurity projects.
🛒 Check Price on AmazonDisclosure: As an Amazon Associate, I earn from qualifying purchases at no additional cost to you.
The Components (All Free)
Cost: Free and open-source. Role: Runs all VMs. Easy to snapshot before testing attacks, revert after. Best alternative to expensive VMware or Hyper-V.
- Download from virtualbox.org
- Install on host machine (Mac/Linux/Windows)
- Enable virtualization in BIOS (if needed)
- Create VMs with 2GB-4GB RAM each
Cost: Free and open-source. Role: Collects logs from all VMs. Detects intrusions. Provides threat intelligence. Equivalent to enterprise Splunk but completely free.
Wazuh runs on 1 Ubuntu VM. All other VMs run Wazuh agents and forward logs to the central server. When I launch attacks on vulnerable VMs, Wazuh detects them in real-time. Exactly like SOC work, but at home.
Watching alerts appear in real time after launching attacks was probably the most satisfying part of building this lab. It helped me understand how detection rules actually work instead of just reading documentation.
- Create Ubuntu 20.04 LTS VM (4GB RAM)
- Follow Wazuh installation docs (docker or native)
- Access via web console (https://localhost)
- Configure agents on other VMs
- Test with intentional traffic/attacks
I spent a lot of time using DVWA because it lets you safely practice common web vulnerabilities without attacking real systems. It became one of my favorite learning resources.
Cost: Free. Role: Intentionally vulnerable applications. Lets me practice exploiting common vulnerabilities and monitoring the attacks with Wazuh.
DVWA is a PHP web application with known vulnerabilities. Perfect for practicing SQL injection, XSS, CSRF. Metasploitable is a Linux box with dozens of exploitable services. This is where I practice penetration testing and incident response simultaneously.
I mostly used Kali for scanning, enumeration, and testing detection rules. Even basic tools like Nmap and Burp Suite generated enough activity to practice log analysis inside Wazuh.
Cost: Free and open-source. Role: Pre-installed with nmap, Metasploit, Burp Suite, and 200+ security tools. I use this to attack the vulnerable VMs and practice exploitation techniques.
Cost: Free 30-day trial (but Wazuh is permanent free). Role: I periodically spin up Splunk to practice with the exact tool used at Inhok Technologies. Query language, dashboards, alert creation — all transferable to work.
My Daily Practice Workflow
Mornings (1 hour): Review Wazuh dashboard from overnight attacks/monitoring. Check for alerts triggered by background traffic. Triage alerts (real vs false positive). Document findings.
Afternoons (1-2 hours): Execute planned attack on vulnerable VM. SSH into Kali Linux, launch Metasploit exploit against Metasploitable. Watch Wazuh detect the attack in real-time. Analyze what Wazuh saw vs what actually happened. Refine detection rules.
Practice scenarios: "Simulate credential theft" → "Detect and contain it". "Simulate data exfiltration" → "Write detection rule". "Simulate privilege escalation" → "Monitor and block it".
Not every exploit worked the first time. Quite a few failed because of configuration mistakes, but fixing those issues ended up teaching me more than simply getting a successful exploit.
What I Learned From Building This
Key Lessons
- RAM is the limiting factor: With 8GB total, running Wazuh server + 2 VMs is manageable. Tried 4 simultaneously and everything crawled. Learned to be selective.
- Snapshots are critical: Before every attack, snapshot the target VM. After attack, revert to clean state. Prevents corrupting your lab environment.
- Network isolation matters: VMs must be on separate virtual networks from host machine. Prevents lab from accidentally attacking your real internet-connected machine.
- Detection rules are hard: Writing a rule that catches real attacks without triggering false positives is genuinely difficult. Lab forced me to understand this before work.
- Logs are overwhelming: A single attack generates 100s of log entries across multiple systems. Sorting signal from noise is 80% of SOC work.
🔒 Secure Your Home Lab Accounts
If you're running GitHub, cloud accounts, Raspberry Pi servers, or cybersecurity labs, protecting your accounts with a hardware security key is one of the best security upgrades you can make.
Recommended: YubiKey Security Key
🛒 Check Price on AmazonFree Alternatives to Every Component
- Instead of VirtualBox: QEMU (Linux), Hyper-V (Windows), VMware Player (limited but free)
- Instead of Wazuh: ELK Stack (Elasticsearch + Logstash + Kibana), Graylog, Splunk free tier (500MB/day limit)
- Instead of Kali: Ubuntu + manual tool installation, ParrotOS, BackBox
- Instead of DVWA: WebGoat, Juice Shop, OWASP Broken Web Applications
0 Comments