Executive Summary

The Enterprise SOC Detection & Perimeter Engineering Home Lab is a production-grade security operations and network perimeter laboratory virtualized inside EVE-NG on nested Linux KVM / QEMU. Designed to simulate complex corporate and industrial enterprise networks, it unifies stateful perimeter firewalling, 802.1Q VLAN micro-segmentation, out-of-band deep packet inspection (DPI), and industrial control systems (ICS/SCADA) security monitoring.

The complete architecture, Ansible automation playbooks, Cisco configurations, and incident response runbooks are maintained in the open-source GitHub Repository.

The lab serves as a live testbed for:

Evaluating adversary emulation tactics originating from an untrusted WAN environment.
Validating firewall filtering rules and NAT policies on OPNsense.
Capturing non-intrusive full-duplex traffic copies via Cisco SPAN port mirroring.
Running high-throughput signature and heuristic detection using Suricata 8.0.7 multi-threaded IDS.
Triaging real-time security events inside EveBox SIEM.

Live Lab Topology & Network Architecture

The environment models five distinct security zones strictly partitioned according to the Purdue Enterprise Reference Architecture (PERA / IEC 62443):

flowchart TD subgraph Zone1 ["Zone 1: Untrusted External WAN (172.31.255.0/24)"] KALI["Kali Linux Red Team\n(172.31.255.100)\nAdversary Emulation"] INET["Internet Gateway\n(172.31.255.1)"] end subgraph Zone2 ["Zone 2: Perimeter Routing & Firewall Inspection"] OPN["OPNsense 24.7 NGFW\n* WAN: 172.31.255.50\n* LAN: 10.10.10.1 (VLAN 10)\n* DMZ: 10.10.20.1 (VLAN 20)\n* OT: 10.10.30.1 (VLAN 30)"] R1["Cisco 7200 Core Router\nTransit Edge (fa0/0)"] end subgraph Zone3 ["Zone 3: Enterprise Core Switching"] SW1["Cisco IOL L2 Core Switch\n* Dot1q VLAN Trunks\n* Port Security\n* SPAN Mirror Port (e0/3)"] end subgraph Zone4 ["Zone 4: Segmented Internal Enclaves"] DMZ["DMZ Web Server\n(10.10.20.10:80 / VLAN 20)"] CORP["Corporate Client PC\n(10.10.10.50 / VLAN 10)"] OT["OT / ICS SCADA Node\n(10.10.30.50:502 / VLAN 30)\nModbus TCP Controller"] end subgraph Zone5 ["Zone 5: SOC Out-of-Band Telemetry Pipeline"] SPAN["Cisco SPAN Clone\n(Promiscuous Interface)"] SURICATA["Suricata 8.0.7 NIDS\nAF_PACKET Multi-Threaded Engine"] EVE_JSON["Telemetry Sink\n/var/log/suricata/eve.json"] EVEBOX["EveBox SIEM Dashboard\n(:5636)"] end KALI --- INET INET --- OPN INET --- R1 OPN ===|802.1Q Multi-VLAN Trunk| SW1 SW1 --- DMZ SW1 --- CORP SW1 --- OT SW1 -.->|Full Duplex Mirror| SPAN SPAN --> SURICATA SURICATA --> EVE_JSON EVE_JSON --> EVEBOX

Purdue Model (PERA / IEC 62443) Segmentation Mapping

To safeguard operational technology without impeding telemetry visibility, network zoning mirrors standard industrial reference frameworks:

Purdue Level	Domain	Subnet & VLAN	Security Controls & Defensive Purpose
Level 5	Enterprise WAN	`172.31.255.0/24` (WAN)	Untrusted external network where red team adversary nodes reside. Zero inbound access to private subnets without stateful NAT translation.
Level 4	Corporate LAN	`10.10.10.0/24` (VLAN 10)	Standard enterprise clients and workstations. Strict inter-VLAN firewall rules prohibit direct lateral movement into OT controller segments.
Level 3.5	Industrial DMZ	`10.10.20.0/24` (VLAN 20)	DMZ application buffer terminating external HTTP connections. Prohibits cross-zone pivoting into lower levels.
Level 3	SOC Monitoring	`10.10.99.0/24` (SPAN/Tap)	Out-of-band telemetry collection. Passive Suricata sniffing interface maintains zero IP presence on monitored segments, preventing probe discovery.
Level 1 / 2	SCADA / OT Control	`10.10.30.0/24` (VLAN 30)	Critical Modbus TCP industrial daemon running on TCP port 502 controlling simulated industrial holding registers and actuators.

Core Infrastructure Engineering

1. Perimeter Firewall & Inter-VLAN Routing (OPNsense 24.7)

The perimeter core runs OPNsense 24.7 featuring:

Stateful Packet Inspection (SPI) with customized ingress/egress rule matrices.
802.1Q Dot1q encapsulation over a virtualized trunk carrying tagged VLANs (10, 20, 30) to the switching fabric.
Port Address Translation (PAT) and 1:1 NAT mapping external testing interfaces to isolated DMZ services.
Strict anti-spoofing bogon filters and automated connection rate limiting.

2. Switching Fabric & SPAN Mirroring (Cisco IOL)

Enterprise core switching is implemented on Cisco IOL (IOS on Linux):

Trunking: 802.1Q sub-interfaces providing Layer 2 transport across virtualized nodes.
Port Security: Static MAC binding on corporate switchports to prevent rogue hypervisor bridging.
Switched Port Analyzer (SPAN): Configured on interface Ethernet0/3 as a dedicated promiscuous destination replicating all bi-directional traffic from VLAN 10, 20, and 30 straight into the detection cluster.

3. Out-of-Band DPI Detection Pipeline (Suricata 8.0.7)

Network traffic mirrored by the SPAN port arrives at the dedicated SOC detection node:

AF_PACKET Ring Buffer: Multi-threaded packet ingestion configured with kernel mmap ring buffers for zero packet drop during burst traffic.
Industrial Protocol Decoders: Built-in Layer-7 decoders for HTTP, TLS, DNS, SSH, and industrial Modbus TCP.
ET Open Ruleset & Custom Signatures: Ingests automated threat intelligence signatures from Emerging Threats alongside bespoke detection logic for SCADA protocol anomalies.
Structured JSON Telemetry: Generates high-fidelity structured logs (eve.json) capturing alert metadata, flow records, DNS transactions, and file hashes.

4. Alert Triage & Incident Monitoring (EveBox SIEM)

The alert sink is parsed by EveBox, an elastic SIEM event viewer providing:

Real-time inbox-style alert aggregation and severity scoring.
Correlation across source IP addresses, attack vectors, and protocol anomalies.
Fast forensic filtering across raw packet payloads and payload hex dumps.

Adversary Emulation & Incident Detection Walkthrough

To validate the defensive architecture, the lab executes scripted attacks from the external Kali Linux red team node against perimeter and internal targets:

Adversary Attack Scenarios

[Kali Red Team] (172.31.255.100)
       │
       │ 1. Modbus TCP Write Request (TCP/502, FC 0x06: Register 0 = 9999)
       ▼
[OPNsense Firewall] (172.31.255.50)
       │
       │ 2. Route evaluation & forwarding to OT Subnet (vtnet3 / VLAN 30)
       ▼
[Cisco IOL Switch] (e0/0 Trunk -> e0/2 Access)
       │
       ├─► 3a. Target Delivery: PLC Node (10.10.30.50:502)
       │
       └─► 3b. [SPAN Port Mirror e0/3]: Full frame copy sent to IDS
               │
               ▼
       [Suricata 8.0.7 NIDS] (AF_PACKET Promiscuous Sniffing)
               │
               ▼
       [EveBox SIEM Alert]: ET SCADA Modbus TCP Setpoint Tampering (SID: 20260941)

Reconnaissance: Nmap SYN stealth scans across perimeter subnets, triggering Suricata portscan heuristics.
Brute-Force Authentication: Hydra dictionary attacks directed against DMZ SSH services, flagged by threshold alerts.
SCADA Modbus Setpoint Tampering: Unauthorized Modbus function code injections attempting to alter PLC holding registers. The packet is simultaneously forwarded to the PLC and cloned via SPAN to Suricata, immediately firing alert INC-2026-0941 into the EveBox dashboard with sub-second latency.

Infrastructure Automation with Ansible

The lab is codified and provisioned using modular Ansible Playbooks:

Base Node Preparation: Installs dependencies, tunes Linux kernel sysctl parameters (net.core.rmem_max, net.core.netdev_max_backlog), and configures network interfaces.
Suricata Orchestration: Deploys multi-worker AF_PACKET configuration templates, automates daily rule updates via suricata-update, and handles service restarts.
EveBox Deployment: Configures background daemons, systemd unit files, and persistent telemetry database storage.

Live Links & References

GitHub Repository: ytp24/eve-soc-homelab
Virtualization Hypervisor: EVE-NG Platform & Linux KVM
Next-Gen Firewall: OPNsense Documentation
Intrusion Detection System: Suricata Engine
SIEM & Event Viewer: EveBox SIEM
Infrastructure Automation: Ansible Documentation
Industrial Protocol: Modbus Organization Standards