soc-stack

Active

You want a real SOC to train on, test detections against, or run as a homelab, but wiring Wazuh, TheHive, Cortex, MISP, Zeek, and Suricata together by hand eats days and breaks on the next rebuild. soc-stack is one curl command on a Proxmox host that stands up all six in dedicated LXCs, cross-wired, in about 30 minutes.

GitHub repo →

6 components9 MCP servers5 cross-wirings~30m deployProxmox LXCMIT

See it work

one question, the tools it calls, the answer

representative session · agent SSHed into a Proxmox host

Stand up the full SOC lab on this Proxmox box, minimal preset, and give me back machine-readable results.

curl -sSL .../install.sh | sudo bash -s -- --components all --preset minimal --ip-mode dhcp --json-out /root/soc-stack.json --mcp-config-out /root/mcp-clients.json

[preflight] Proxmox VE 8.2 · bridge vmbr0 · storage local-lvm ok [wazuh] LXC 9001 192.0.2.11 deployed verify ok [thehive-cortex] LXC 9002 192.0.2.12 deployed verify ok [misp] LXC 9003 192.0.2.13 deployed verify ok [zeek-suricata] LXC 9004 192.0.2.14 deployed verify ok [dashboards] LXC 9005 192.0.2.15 deployed verify ok [mcp] LXC 9006 192.0.2.16 deployed verify ok [integrate] wazuh->thehive misp->suricata zeek->wazuh thehive<->cortex mcp<-peers 5/5 wired [done] 6/6 components exit 0 -> /root/soc-stack.json /root/mcp-clients.json

Full stack is green in one pass: 6 LXCs deployed and verified, all 5 cross-component integrations wired, exit 0. soc-stack.json has every VMID, IP, and endpoint (secrets redacted), and mcp-clients.json is a paste-ready mcpServers block for all 9 security tools.

Representative full-stack run. Illustrative values, RFC 5737 addresses. Everything is self-hosted on hardware you control; no telemetry, no phone-home.

What it does

soc-stack is a one-command, self-hosted SOC lab builder: run one curl on a Proxmox VE host and roughly 30 minutes later you have Wazuh (SIEM/XDR), TheHive + Cortex (case management + SOAR), MISP (threat intel), Zeek + Suricata (NSM + IDS), dashboards, and 9 MCP servers, each in its own unprivileged LXC and already wired to its peers. It exists because assembling six upstream tools plus the integrations between them (alert forwarding, analyzer wiring, IOC feeds, log shipping) is a multi-day project that has to be redone every rebuild. It differs from a single all-in-one SIEM appliance by treating the whole stack as one declarative, idempotent, agent-friendly deploy: components are the real upstream projects at pinned versions (not a fork), each lives in its own snapshot-able LXC, the run is non-interactive with structured JSON output, and state files (not a state backend) drive idempotent re-runs.

Capabilities

Six components, each in its own LXC

WazuhSIEM / XDR

Manager, Indexer, Dashboard for alerting, FIM, vulnerability detection, and agent management.

TheHive + Cortexcase + SOAR

Case management with Cortex analyzers and responders for observable enrichment.

MISPthreat intel

IOC sharing, feeds, and correlation, feeding Suricata rules on an hourly pull.

Zeek + SuricataNSM + IDS/IPS

Network security monitoring and intrusion detection, shipping logs into Wazuh.

DashboardsBro Hunter + Playbook Forge

Custom hunt and playbook dashboards served behind nginx.

MCP servers9 servers

Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, MITRE ATT&CK, Rapid7, and Sophos exposed to any MCP client over SSE via mcp-proxy.

Full reference on GitHub →

Set it up

curl -sSL https://raw.githubusercontent.com/solomonneas/soc-stack/main/install.sh | sudo bash

Run as root on a Proxmox VE 7/8/9 host with a bridge (default vmbr0) and storage pool; needs ~12 GB free RAM and ~150 GB disk for the full stack at minimal preset. Tune with --components, --preset, --bridge, --storage, --ip-mode, and --manifest.

agent-driven run

curl -sSL .../install.sh | sudo bash -s -- \
  --components all --preset minimal \
  --ip-mode dhcp \
  --json-out /root/soc-stack.json \
  --mcp-config-out /root/mcp-clients.json

[ shield ]

Non-interactive and idempotent: re-running with the same flags skips anything already deployed, and exit codes are stable (0 success, 1 preflight, 2 validation, 3 component failed, 4 integration failed, 5 mixed state). Generated credentials are rotated on deploy and stored root-only at mode 0600, result JSON is redacted unless you pass --include-secrets-json, and the 9 MCP servers bind to localhost unless you pass --mcp-bind-host 0.0.0.0. It is a lab tool that assumes a trusted host and internal bridge, not a hardened multi-tenant production SOC; the threat model lives in SECURITY.md.

components

MCP servers

cross-wirings

~30m

full deploy

MIT

license