Building-a-Mini-SOC-Lab-with-Security-Onion

Introduction:

The Importance of a Home Lab

Having a home lab is crucial for cybersecurity professionals, especially those starting their journey in the field. It provides a safe and controlled environment to gain hands-on experience, experiment with various tools and techniques, and simulate real-world scenarios. A home lab allows us to practice and refine our skills, test different security solutions, and stay up to date with the latest threats and vulnerabilities. It also offers an opportunity to explore various aspects of cybersecurity, such as incident response, threat hunting, and network monitoring, in a practical setting.

What is Security Onion?

SecurityOnion is an open-source tool that helps organizations build and monitor their security operations center (SOC). It provides a platform for network security monitoring (NSM) and log management, enabling the detection, analysis, and response to security incidents. Security Onion includes various components and tools, such as Suricata for intrusion detection, Zeek for network traffic analysis, and Elasticsearch for log storage and analysis. It offers a comprehensive set of features to assist in threat detection, incident investigation, and overall network security. By setting up a mini SOC lab with Security Onion, you can gain practical experience in using these tools and understand how they contribute to a robust security infrastructure.

Objective

This guide will help cybersecurity beginners like myself get hands-on experience in building and managing a mini SOC with Security Onion. We will set up a vulnerable machine and an attacking machine to simulate a real-world attack scenario. We’ll dive into monitoring network traffic and detecting suspicious activities. We will cover the installation process and simulate common security incidents to practice our detection and response skills.

Hardware Minimum Requirements

Storage: 300 GB
Ram: 16 GB
CPU: 6 cores

Project Items needed

VirtualBox and extension pack link
Vulnhub link
1x SecurityOnion iso link
1x Ubuntu Desktop link
Kali Linux ISO file link

VM Topology

To prepare for that we need to set up a network topology where the VMs can talk to each other. Like this:

In Oracle VM manager go to file>tools>network manager

Add a new NAT Network and a Host-only Network like this

Kali VM setup

Just like the Windows VM add the ISO and modify the hardware

Add VM to NAT Network and add Host-only adapter 1
Once you turn on the VM select Graphical install
Choose your language, keyboard layout, and country
Make a hostname, username, and password (domain name is optional)
Select Use entire disk, then select all files in one position
Select yes and format the disk
Select any software you want installed with the OS and press continue(default is fine)
Lastly, Install the GRUB bootloader and select the boot device

Security Onion VM setup

This is a long process so read carefully

just like the Windows setup make a username, password, and host
DO not check the guest additions box
SecurityOnion needs at least 200GB of storage, 12 GB of RAM, and 4 CPU cores
Select finish and don’t power up the VM
in network settings switch to NAT Network with a second adapter attached to Host-only adapter 1
Select Install Security Onion and type “yes” to proceed
Create a username and password to install (this will take a while)
Press enter to reboot and select the first CentOS Linux
Log in and select Yes > Install > EVAL> type “AGREE”
Enter a FQDN (”seconion” is fine)
select the first option as the management and use DHCP
select standard > direct
select the second option as your monitor interface
Set automatic for updates
Add your NAT network IP and Adapter 1 Host-only interface IP(you can find these at file> tools> network manage)
Remove any software you won’t be using(Default is fine)
For this project choose a fake email address to log into for later use (ex: [email protected])
Select IP address > NTP yes > OK > SO-Allow NO
Scroll down and select yes to install (this will take Long)
Take note of the web interface URL for later use and reboot

Ubuntu VM setup

just like the Windows setup make a username, password, and host
Modify the hardware and finish (at least 2 cores is needed)
add the VM to the NAT network
start the machine
Press Install Ubuntu
you may need to enter your user and password to finish installing

Now we are going to set the VM to work as an analyst for SecurityOnion

first, go to the terminal and type “sudo apt install net-tools” (if you are not in the sudoers file type “su -” > enter password > type “sudo adduser [your username] sudo”)
type “ip add” and take note of the IP address
now enter the SecurityOnion web URL in Firefox
now powerup SecurityOnion
in the terminal type “sudo so-allow”
select “a” for analyst
then enter the IP address of the Ubuntu VM
Now refresh the web URL in Ubuntu
Click Advanced > accept the risk > and sign in with the email you made for the Security Onion web interface

Vulnhub (proof of concept)

Go to the vulnhub and download a vulnerable machine to check if SecurityOnion is working.

Here is an easy box: Basic Pentesting 1

Import the VM
Set the Network to Host-only adapter 1 (DO NOT CONNECT TO NAT)
Power the Vulnhub machine
Power up the kali machine
Make sure kali is connected to 2 network interfaces using the “ifconfig” command
Perform a Nmap scan for the Vulnhub IP ( Ex: nmap -sn 192.168.188.1–255)
Once you find the IP perform another Nmap scan (Ex: nmap -sV -sC -T4 [Vulnhub IP]) As we can see Security Onion has already picked up some activity from the Kali machine. You can explore the other tools like Kibana to check this too. This activity indicates the successful implementation of our network monitoring system, offering us valuable insights into potential security threats.

Summary

That is the end of my mini SOC lab project. I hope you were able to learn something new and gain some hands-on knowledge about network monitoring and threat detection. With consistent practice and exploration, you can further improve your skills in this area and become adept at identifying and mitigating potential security threats in real time.

S/O to DayCyberwox for the inspiration and resources for this project.

P.S :

If you want to continue attacking and monitoring the machine here is a well-done guide from InfoSec Pat to help root it

renanzg / building-a-mini-soc-lab-with-security-onion Goto Github PK