soc-stack
WIPOne-command SOC lab on Proxmox.
WHAT IT DOES
SOC Stack runs one command on a Proxmox VE host and, roughly 30 minutes later, hands you a working Security Operations Center: Wazuh (SIEM/XDR), TheHive + Cortex (case management + SOAR), MISP (threat intel), Zeek + Suricata (NSM + IDS), custom dashboards, and 9 MCP servers, all wired up and talking to each other. Each component runs in its own dedicated LXC.
It is non-interactive by default, idempotent, and emits JSON for agents, so an AI agent can SSH into a Proxmox host and one-shot a SOC. Exit codes are stable (0 success, 1 preflight, 2 validation, 3 component failed, 4 integration failed, 5 mixed state), and re-running with the same flags skips anything already deployed.
Generated credentials are root-only, result JSON is redacted by default, and MCP
servers bind to localhost unless you pass --mcp-bind-host 0.0.0.0.
Status: work in progress. v1.0.0 has all 6 components and 5 cross-component integrations verified end-to-end on Proxmox VE, with self-hosted CI on every PR. It is a self-hosted installer, not an MCP server, so there is no AI-client config block: you run it on the host. It is not published to a package registry.
RUNNING IT
Prerequisites: a Proxmox VE 7.x / 8.x / 9.x host with root access, a bridge
(default vmbr0) and storage pool (auto-detected), outbound HTTPS, and
roughly 12 GB free RAM plus 150 GB free disk for the full stack at the minimal preset.
The installer auto-installs jq, curl, wget, and
openssl if missing.
Full stack, sensible defaults, one command on the Proxmox host:
Custom subset, with bridge and storage pinned:
Agent-driven, fully non-interactive with structured output:
After install, /root/soc-stack.json lists every component's LXC VMID, IP,
ports, endpoints, and secret file paths (passwords redacted by default), and
/root/mcp-clients.json is a paste-ready mcpServers block for
your MCP client. Validate first with --dry-run; redeploy a component with
--force.
COMPONENTS
Six components, each in its own dedicated LXC. Deploy them independently or together; the orchestrator handles VMID allocation, networking, idempotency, and cross-component wiring. LXC sizes shown are the minimal preset.
CROSS-COMPONENT WIRING
Configured automatically after all components deploy, so the SOC is integrated rather than six tools sharing a host.