Build a Home SOC: A Practical SIEM Lab That Teaches Detection Engineering

Start With the Questions You Want to Answer

Before installing a SIEM, define a few detection goals: failed-logon bursts, new local administrators, suspicious PowerShell, unexpected outbound connections, persistence creation, or web-server authentication anomalies. This tells you what logs you actually need.

A Small Architecture Is Enough

You can learn the workflow with one Windows VM, one Linux VM, a log platform, and an attacker/test VM isolated from anything important. Feed Windows event logs, Sysmon if you choose to deploy it, Linux authentication logs, web-server logs, DNS or firewall logs, and your endpoint/security tooling into one searchable place.

Normalize Before You Chase Fancy Analytics

Make sure timestamps are correct, hostnames are consistent, usernames are parsed, source/destination fields are usable, and retention is predictable. Detection engineering becomes frustrating when the same concept appears under five field names or systems disagree about time.

Write Detections as Hypotheses

A detection should express a behavior you care about and why it might matter. “PowerShell ran” is usually noisy. “PowerShell launched with encoded content from an unusual parent process on a workstation that rarely uses PowerShell” is a more useful analytic hypothesis.

For each detection, document the data source, query, expected benign cases, likely false positives, severity, investigation steps, and what would confirm or disprove the suspicion.

Generate Known Activity

Run safe, controlled simulations in your lab. Create a local user, add it to an administrative group, schedule a benign task, make failed logons, execute a harmless PowerShell script, and connect to a test web service. Then verify that your telemetry can reconstruct what you intentionally did.

Practice the Investigation Loop

• Alert fires.
• Validate the raw event.
• Identify the user, host, process, and time.
• Pivot to surrounding events.
• Search the environment for the same indicator or behavior.
• Write a short conclusion and note uncertainty.
• Tune the rule only after you understand the false positive.

Metrics That Actually Help

Track whether the data source is healthy, how many detections have documented triage steps, how often rules fire without useful context, and how quickly you can reconstruct a known simulation. A home lab does not need enterprise KPIs; it needs feedback that improves your investigative discipline.

Bottom Line

A home SOC is valuable because it forces you to connect offensive behavior, endpoint artifacts, network evidence, and analyst reasoning. The product matters less than the habit: collect, detect, pivot, explain, tune, repeat.