SOC Analyst Home Lab Blueprint — Free Tools, Real Detections
A working SOC analyst home lab you can build in 40 hours with a 32 GB desktop. Every tool listed is free open source. The blueprint below is the same stack Networkers Home students touch in Months 4 and 7 of the 8-month cyber security course in Bangalore — trimmed down to the free-tier layer so anyone with a mid-range machine can practise the exact detection-engineering workflow real SOCs run in 2026.
Reviewed by Nikunj Gohil (Dual CCIE Security + Enterprise) and Ajay Kumawat (CCNP Security · PCNSE · SIEM Specialist). Vetted against the actual SOC/SIEM Module curriculum they teach at Networkers Home HSR Layout.
Why build a home lab at all?
Bangalore SOC hiring managers in 2026 rarely offer L1 analyst roles to freshers who can only describe how a SIEM works. They offer them to freshers who can show a Sigma rule they wrote, a screenshot of an alert it fired, and a two-line disposition of what they'd escalate. This is the artefact set — a home lab produces all three.
The stack in this blueprint costs zero rupees in software. It costs some hours setting up. What it buys is the interview credibility freshers cannot get from a certification exam alone — because certifications test knowledge, and hiring managers test whether you've actually pointed a query at a log.
The Networkers Home 8-month cyber security course in Bangalore runs a bigger version of this lab with real Palo Alto, Fortinet, Cisco ASA hardware plus the 24Observe AI-SOC layer — but every skill built in this home-lab version is directly transferrable.
Minimum viable rig
The full stack runs comfortably on this spec. You can trim (drop Splunk Free and Elastic; keep only Wazuh) if your machine is smaller — the detection-engineering skill still transfers.
- cpu
- 4-core CPU (Intel i5 8th gen / AMD Ryzen 5 3600 or newer)
- ram
- 32 GB (16 GB works but you'll page-swap when Splunk + Elastic both run)
- disk
- 500 GB NVMe SSD (SIEMs are IO-bound; SATA HDD makes queries painfully slow)
- hypervisor
- Proxmox VE (free, KVM-based) or VMware Workstation (free for personal)
- network
- Isolated internal-only vSwitch so attack traffic never leaks to your home LAN
The 8-layer stack
Each layer is deliberately vendor-primary — download from the source, not a mirror. Bookmark the vendor download URLs; a lot of tutorials link to stale forks.
1. Log collection · Wazuh Agent
Endpoint agent installed on lab VMs (Windows + Linux) that ships auth logs, file-integrity events, sysmon telemetry and rootkit-detection alerts to a central Wazuh Manager.
Vendor download → wazuh.com/2. Log normalisation + SIEM · Wazuh Manager + OpenSearch
Central SIEM. Normalises agent telemetry into common fields, correlates against 2,000+ built-in rules, indexes to OpenSearch for query + dashboarding.
Vendor download → documentation.wazuh.com/current/installation-guide/index.html3. Network detection · Suricata
Network IDS/IPS on the lab VLAN. Detects malware C2, protocol anomalies, and known-bad payloads using the Emerging Threats Open ruleset. Alerts stream to Wazuh via Suricata's EVE JSON output.
Vendor download → suricata.io/4. Alternate SIEM for parity · Splunk Free
Second SIEM. Same log sources ingested via HTTP Event Collector. Lets a learner practise both SPL (Splunk) and OpenSearch DSL / KQL-lite (Wazuh) query languages against identical data.
Vendor download → www.splunk.com/en_us/download/splunk-enterprise.html5. Elastic Stack (optional) · Elasticsearch + Kibana
Third SIEM for candidates targeting employers standardised on Elastic. Beats-based agents forward the same logs. Practising Kibana queries + Lens visualisations is a distinct skill Elastic-shop employers explicitly test for.
Vendor download → www.elastic.co/downloads/6. Detection engineering · Sigma + PySigma
Vendor-neutral detection format. Author a rule once in Sigma YAML; use PySigma to compile it to Splunk SPL, Wazuh XML, and Elastic KQL simultaneously. This is the workflow real SOC engineering teams use in 2026.
Vendor download → github.com/SigmaHQ/sigma7. Attack simulation · Atomic Red Team + Caldera
Atomic Red Team fires small, focused MITRE ATT&CK-mapped attack sequences against your lab endpoints. Caldera runs longer multi-step adversary campaigns. Both produce the telemetry your detections need to actually detect something.
Vendor download → github.com/redcanaryco/atomic-red-team8. IOC + threat intel · MISP (Malware Information Sharing Platform)
Community threat intel platform. Ingests IOC feeds (IPs, hashes, URLs), enriches events flowing through Wazuh, and lets learners practise the enrichment workflow real SOCs run before escalating an incident.
Vendor download → www.misp-project.org/The 5 milestones that make you hireable
Every milestone below produces an artefact you can put in a GitHub repo and screenshot into a resume. That artefact — not the lab itself — is what closes the hiring loop.
Stack live
Wazuh Manager, agent on Ubuntu, agent on Windows 10, OpenSearch dashboards loading. First Wazuh alert visible in dashboard when you SSH to Ubuntu with a wrong password.
First detection you wrote yourself
Author a Sigma rule that detects PowerShell downloading a file from a non-corporate domain. Compile it via PySigma to both Wazuh XML and Splunk SPL. Trigger it with Atomic Red Team test T1105.001. Verify the alert fires in both SIEMs.
Multi-stage attack chain caught
Run a Caldera campaign that chains initial access → discovery → credential access → lateral movement. Write correlation rules that catch the CHAIN, not just individual steps. This is the L1 → L2 skill jump.
IOC enrichment loop
Configure MISP with 3 free threat feeds (abuse.ch, AlienVault OTX Free, blocklist.de). Wire Wazuh to auto-enrich alerts with MISP lookups. Ship a screenshot of a Wazuh alert showing IOC context — this is a portfolio artefact recruiters explicitly ask to see.
Documented dispositions
For every alert your lab fires, write a 3-line disposition: (a) what happened, (b) what you'd escalate/close, (c) what evidence you'd attach. Store these in a public GitHub repo. This is the artefact that turns a home-lab hobbyist into a hireable SOC L1.
When you're ready to skip the setup
The full Networkers Home cyber security programme runs the same detection-engineering workflow at scale — but on real multi-vendor firewall hardware (Palo Alto, Fortinet, Cisco ASA), the 24Observe AI-SOC platform, and 800+ pan-India hiring partners for placement. If the home lab confirms cyber security is the career, the 8-month course removes the setup + hardware ceiling.
Corrections and updates
Tool versions change. If any vendor download URL 404s, or a license changes, email rocky@networkershome.com and we'll update this page. Last verified: 2026-08-06. Published: 2026-08-06. This page will note the changelog inline as the stack evolves.