<aside> 🔖

Table of Contents

</aside>

Project Summary

Project Title: Enterprise-Level SOC Lab | Engineering a Multi-Zone Infrastructure for Threat Detection

Platform: On-Premises Hyper-V Lab Environment

Project Scope: Building a self-contained detection lab using pfSense, Suricata IDS, Active Directory, Windows clients, and Splunk SIEM for real-time security monitoring.

Author: Athanasios Oikonomopoulos / B4ckD00rR4t

This project was designed to replicate core components of a functional Security Operations Center (SOC) within a segmented enterprise network environment. Deployed entirely in Hyper-V, the lab includes a pfSense firewall with integrated Suricata IDS, a Windows Server 2019 Domain Controller, Windows 10 client systems, a Splunk SIEM, and a Kali Linux attacker machine , all interconnected across five dedicated virtual switches representing different network zones.

The main goal of this lab was to build and validate an infrastructure capable of detecting, forwarding, and correlating malicious or suspicious activity across multiple layers , including firewall events, host-level telemetry, and IDS alerts , using industry-standard tools.

Throughout the project, I:

• Created five Hyper-V virtual switches to isolate traffic between WAN, Attacker, Victim, Splunk, and Management networks
• Deployed pfSense CE 2.7.2 and configured static IPs on each interface for reliable segmentation
• Installed Suricata IDS on pfSense, enabling inline traffic inspection to detect scanning and probing behavior
• Set up a Windows Server 2019 VM with Active Directory Domain Services, DNS, and Enterprise Root CA
• Provisioned a Windows 10 client, joined to the domain and configured with firewall logging and Splunk Universal Forwarder
• Installed Splunk Enterprise on Ubuntu Server, collecting Windows event logs in near real-time
• Simulated attacker activity from Kali Linux, including Nmap scans to test detection workflows
• Correlated alerts and host telemetry using Splunk searches and Suricata signatures to confirm end-to-end detection pipeline functionality