Skip to content
mohammad@arabieh
:~/projects$
(home)
This page needs JavaScript to show its content. You can still
download the resume (PDF)
.
home
projects
hybrid-soc
Hybrid SOC lab architecture
On the on-prem side, simulated attacks target an internal lab segment behind an OPNsense firewall that handles rules, NAT and traffic control. OPNsense firewall logs and Google Cloud firewall logs both flow into Wazuh SIEM/XDR, which runs 15+ custom MITRE ATT&CK-mapped rules. n8n SOAR automates the incident-response workflows.
on-prem lab
Attack simulation
brute-force · lateral movement
phishing
Internal segment
lab hosts
OPNsense firewall
rules · NAT · traffic control
google cloud
Google Cloud firewall
cloud firewall logs
Wazuh SIEM/XDR
collect · analyze · 15+ ATT&CK rules
n8n SOAR
incident-response workflows
firewall logs
IR workflows