soc-stack

Active

You want a real SOC to train on, test detections against, or run as a homelab, but wiring Wazuh, TheHive, Cortex, MISP, Zeek, and Suricata together by hand eats days and breaks on the next rebuild. soc-stack is one curl command on a Proxmox host that stands up all six in dedicated LXCs, cross-wired, in about 30 minutes.

GitHub repo →

$curl -sSL https://raw.githubusercontent.com/solomonneas/soc-stack/main/install.sh | sudo bash

~30m deployProxmox LXC

See it workrepresentative session

you

Stand up the full SOC lab on this Proxmox box, minimal preset, and give me back machine-readable results.

tool

curl -sSL .../install.sh | sudo bash -s -- --components all --preset minimal --ip-mode dhcp --json-out /root/soc-stack.json --mcp-config-out /root/mcp-clients.json

result

[preflight] Proxmox VE 8.2 · bridge vmbr0 · storage local-lvm ok [wazuh] LXC 9001 192.0.2.11 deployed verify ok [thehive-cortex] LXC 9002 192.0.2.12 deployed verify ok [misp] LXC 9003 192.0.2.13 deployed verify ok [zeek-suricata] LXC 9004 192.0.2.14 deployed verify ok [dashboards] LXC 9005 192.0.2.15 deployed verify ok [mcp] LXC 9006 192.0.2.16 deployed verify ok [integrate] wazuh->thehive misp->suricata zeek->wazuh thehive<->cortex mcp<-peers 5/5 wired [done] 6/6 components exit 0 -> /root/soc-stack.json /root/mcp-clients.json

agent

Full stack is green in one pass: 6 LXCs deployed and verified, all 5 cross-component integrations wired, exit 0. soc-stack.json has every VMID, IP, and endpoint (secrets redacted), and mcp-clients.json is a paste-ready mcpServers block for all 9 security tools.

Representative full-stack run. Illustrative values, RFC 5737 addresses. Everything is self-hosted on hardware you control; no telemetry, no phone-home.

What it does

soc-stack is a one-command, self-hosted SOC lab builder: run one curl on a Proxmox VE host and roughly 30 minutes later you have Wazuh (SIEM/XDR), TheHive + Cortex (case management + SOAR), MISP (threat intel), Zeek + Suricata (NSM + IDS), dashboards, and 9 MCP servers, each in its own unprivileged LXC and already wired to its peers. It exists because assembling six upstream tools plus the integrations between them (alert forwarding, analyzer wiring, IOC feeds, log shipping) is a multi-day project that has to be redone every rebuild. It differs from a single all-in-one SIEM appliance by treating the whole stack as one declarative, idempotent, agent-friendly deploy: components are the real upstream projects at pinned versions (not a fork), each lives in its own snapshot-able LXC, the run is non-interactive with structured JSON output, and state files (not a state backend) drive idempotent re-runs.

CapabilitiesSix components, each in its own LXC

Wazuh

SIEM / XDR

Manager, Indexer, Dashboard for alerting, FIM, vulnerability detection, and agent management.

TheHive + Cortex

case + SOAR

Case management with Cortex analyzers and responders for observable enrichment.

MISP

threat intel

IOC sharing, feeds, and correlation, feeding Suricata rules on an hourly pull.

Zeek + Suricata

NSM + IDS/IPS

Network security monitoring and intrusion detection, shipping logs into Wazuh.

Dashboards

Bro Hunter + Playbook Forge

Custom hunt and playbook dashboards served behind nginx.

MCP servers

9 servers

Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, MITRE ATT&CK, Rapid7, and Sophos exposed to any MCP client over SSE via mcp-proxy.

Full tool reference on GitHub →

Setup

01 · install

curl -sSL https://raw.githubusercontent.com/solomonneas/soc-stack/main/install.sh | sudo bash

02 · configure

Run as root on a Proxmox VE 7/8/9 host with a bridge (default vmbr0) and storage pool; needs ~12 GB free RAM and ~150 GB disk for the full stack at minimal preset. Tune with --components, --preset, --bridge, --storage, --ip-mode, and --manifest.

03 · agent-driven run

curl -sSL .../install.sh | sudo bash -s -- \
  --components all --preset minimal \
  --ip-mode dhcp \
  --json-out /root/soc-stack.json \
  --mcp-config-out /root/mcp-clients.json

Safety

how it stays safe

Non-interactive and idempotent: re-running with the same flags skips anything already deployed, and exit codes are stable (0 success, 1 preflight, 2 validation, 3 component failed, 4 integration failed, 5 mixed state). Generated credentials are rotated on deploy and stored root-only at mode 0600, result JSON is redacted unless you pass --include-secrets-json, and the 9 MCP servers bind to localhost unless you pass --mcp-bind-host 0.0.0.0. It is a lab tool that assumes a trusted host and internal bridge, not a hardened multi-tenant production SOC; the threat model lives in SECURITY.md.

More in Security / SOC8 tools

wazuh-mcpRead your Wazuh SIEM from your agent: alerts, agents, and CVEs, read-only. misp-mcpTurn MISP threat intel into answers: events, correlations, and IOC exports on demand. suricata-mcpHunt Suricata and Zeek NSM logs from your agent: alerts, flows, and C2 analytics. thehive-mcpDrive TheHive incident response from your agent: cases, alerts, tasks, observables. cortex-mcpDetonate an indicator and get one verdict: Cortex analyzers, confirm-gated. mitre-mcpMap alerts to ATT&CK and profile threat groups without leaving your agent. zeek-mcpQuery and correlate Zeek and Suricata NSM logs from your agent. hotwashBuild IR playbooks as flowcharts and run them step by step, agent-drivable.