A virtualized enterprise cybersecurity environment demonstrating the complete Attack → Detection → Investigation lifecycle using Kali Linux, Ubuntu Server, Apache, ModSecurity, OWASP CRS, Snort, Suricata, Docker, and Wazuh SIEM.
The Enterprise Security Operations Lab is an enterprise-inspired virtual cybersecurity environment designed to emulate a modern Security Operations Center (SOC) within a controlled laboratory setting.
Developed during the CyberGenX Cybersecurity Internship, the project integrates offensive security testing with defensive monitoring by combining Web Application Firewall (WAF), Intrusion Detection Systems (IDS), and Security Information and Event Management (SIEM) technologies into a single security ecosystem.
The objective of this project is not to compromise vulnerable applications, but to validate defensive visibility, security monitoring, attack detection, log correlation, and incident investigation capabilities across an enterprise-style infrastructure.
The laboratory consists of three interconnected virtual machines working together to simulate an enterprise security monitoring environment.
| Virtual Machine | Purpose |
|---|---|
| Kali Linux | Reconnaissance, validation and attack simulation |
| Ubuntu Security Lab | Apache, ModSecurity, Snort, Suricata and vulnerable applications |
| Wazuh SIEM | Centralized monitoring, correlation and investigation |
The environment demonstrates the complete security monitoring lifecycle:
Reconnaissance
↓
Traffic Generation
↓
Apache Web Server
↓
ModSecurity WAF
↓
OWASP CRS
↓
Snort IDS
↓
Suricata IDS
↓
Wazuh Agent
↓
Wazuh Manager
↓
Indexer
↓
Dashboard
↓
Threat Investigation
- Design and deploy a multi-VM enterprise-inspired cybersecurity laboratory.
- Simulate controlled reconnaissance and web security assessments.
- Protect vulnerable web applications using Apache, ModSecurity and OWASP CRS.
- Detect malicious activity using Snort and Suricata.
- Centralize security monitoring using Wazuh SIEM.
- Demonstrate the complete Attack → Detection → Investigation workflow.
- Produce reusable automation scripts and deployment documentation.
| Category | Technologies |
|---|---|
| Operating Systems | Kali Linux, Ubuntu Server |
| Virtualization | VMware Workstation |
| Web Server | Apache2 |
| Web Application Firewall | ModSecurity |
| Rule Set | OWASP Core Rule Set (CRS) |
| Intrusion Detection | Snort, Suricata |
| SIEM Platform | Wazuh SIEM |
| Containerization | Docker |
| Vulnerable Applications | bWAPP, Mutillidae II, SQLi Labs, Juice Shop, DVGA, PyGoat, WebGoat |
| Offensive Security Tools | Nmap, Nikto, cURL |
| Automation | Bash |
| Version Control | Git & GitHub |
| Documentation | Markdown, PDF, DOCX |
+---------------------------+
| Kali Linux VM |
| Recon • Validation • Scan |
+------------+--------------+
|
|
▼
+---------------------------+
| Ubuntu Security Lab |
|---------------------------|
| Apache |
| ModSecurity + OWASP CRS |
| Snort IDS |
| Suricata IDS |
| Docker Applications |
+------------+--------------+
|
Wazuh Agent
|
▼
+---------------------------+
| Wazuh SIEM |
|---------------------------|
| Manager |
| Indexer |
| Dashboard |
+---------------------------+
- Controlled reconnaissance using Nmap
- Web server enumeration with Nikto
- HTTP header validation using cURL
- Automated Bash-based demonstrations
- Safe testing inside an isolated virtual environment
- Apache Web Server
- ModSecurity Web Application Firewall
- OWASP Core Rule Set (CRS)
- Snort Intrusion Detection System
- Suricata Intrusion Detection System
- Wazuh Agent monitoring
- Centralized log collection
- Event correlation
- Threat hunting
- Dashboard visualization
- Infrastructure health monitoring
- Kali automation scripts
- Ubuntu validation scripts
- Wazuh validation scripts
- Automated evidence collection
- Demonstration automation
| Deliverable | Status |
|---|---|
| Technical Report | ✅ |
| Installation Guide | ✅ |
| Project Handover Document | ✅ |
| Demonstration Recording | ✅ |
| Automation Scripts | ✅ |
| Validation Evidence | ✅ |
| Deployment Documentation | ✅ |
Enterprise-Security-Operations-Lab
│
├── architecture/
├── assets/
├── configs/
├── demo/
├── docs/
├── evidence/
├── presentation/
├── reports/
├── screenshots/
├── scripts/
│
└── README.md
| Document | Description |
|---|---|
| README | Project overview |
| Installation Guide | Complete deployment instructions |
| Technical Report | Detailed implementation report |
| Project Handover | Operational guide |
| Demonstration Recording | End-to-end lab walkthrough |
Screenshots demonstrating the laboratory infrastructure, attack simulations, security detections and Wazuh dashboards will be added here.
- Expand attack simulation scenarios.
- Integrate Sigma detection rules.
- Add custom Wazuh detection rules.
- Improve dashboard visualizations.
- Automate infrastructure deployment.
- Add CI/CD validation.
- Publish detailed architecture diagrams.
Computer Engineering Student
Cybersecurity • SIEM • Blue Team • Detection Engineering
Built during the CyberGenX Cybersecurity Internship
GitHub https://github.com/nirmitrip
Portfolio https://nirmitrip.github.io/NirmitRES.github.io/
The complete walkthrough demonstrates the entire Attack → Detection → Investigation lifecycle of the Enterprise Security Operations Lab.
- ✅ Infrastructure Validation
- ✅ Network Reconnaissance
- ✅ Web Application Enumeration
- ✅ Attack Simulation
- ✅ Apache & ModSecurity WAF Validation
- ✅ Snort & Suricata IDS Detection
- ✅ Wazuh SIEM Monitoring
- ✅ Security Investigation
- ✅ Evidence Collection
Click the image or button above to watch the complete demonstration.
Note: The demonstration video is hosted externally because GitHub repositories cannot store files larger than 100 MB.
This project was designed and implemented as part of the CyberGenX Cybersecurity Internship, combining enterprise-inspired defensive security concepts with practical hands-on implementation across offensive security testing, web application protection, intrusion detection and SIEM monitoring.