Cloud-Based SOC Home Lab Development

@ambientinfotech

Hello, I proffesionalize in hosting and server management, I have 8 year experience with Share/VPS/AWS & Cloud server management. Your bugs/updates are clear however, I would like to know more details about your server before starting. I assure you professionalism, creativity and loyalty. Let's Chat!!!

@ZohaibSathio

Hi, a SOC lab on AWS where Wazuh detects, Shuffle responds and a dashboard shows both. What kills these labs is alert noise: playbooks fire on everything and you stop trusting them. How I would build it: CloudTrail, GuardDuty and agent logs into Wazuh, rules tuned per case before anything gets automated, then Shuffle playbooks for brute force, IAM misuse, malware and odd traffic, with IP reputation enrichment before each one acts. IAM on least privilege roles, docs written as I go. Which path should work first, IAM misuse or brute force? I have run monitoring and alerting on a production banking stack. Happy to take the first milestone so you can judge the alerts. Regards, Zohaib

@manishashree12

Hello there, I specialize in cloud-based security solutions and AWS platforms. I would enhance your SOC home lab by integrating Wazuh for monitoring, Shuffle SOAR for automated response, and AWS IAM for access management. I will configure real-time alerts, threat intelligence tools, and incident response playbooks. Troubleshooting and optimizing the existing setup, I will ensure security best practices are followed. Your SOC dashboard will visualize alerts effectively. I am keen to discuss the project further and collaborate on this exciting development. Thanks,

@Cruz1217

Setting up a cloud-based SOC with Wazuh and Shuffle SOAR requires careful planning to handle the high volume of logs without overwhelming the system. I would start by architecting a centralized logging pipeline that feeds directly into Wazuh for real-time analysis. This setup ensures that every alert is captured and routed to the correct playbooks in Shuffle SOAR for immediate action. A common mistake in these environments is treating the dashboard as a passive reporting tool rather than an active command center. I will build the dashboard to show live threat feeds and allow operators to triage incidents directly from the interface. You will get a fully functional lab where automated workflows handle brute-force attempts and IAM anomalies without manual intervention.

@Sergeantsly

Hello, I can develop and improve your AWS-based SOC lab using Wazuh, Shuffle SOAR, IAM, threat intelligence, and real-time alerting. My background includes Linux administration, infrastructure monitoring, networking, automation, and technical documentation. I’ll first review your existing GitHub project, then: • Secure and optimize the AWS/Wazuh environment • Monitor AWS resources and IAM activity • Build Shuffle playbooks for brute-force, malware, unauthorized IAM, and suspicious-network events • Integrate IP-reputation threat intelligence • Configure dashboards and real-time notifications • Test each workflow and provide complete setup documentation Which components are already functional, and which issue should be addressed first? Regards, Sylvester Sylvect IT Services

@indreshpnk

Hello, I understand you need a cloud-based SOC home lab on AWS with Wazuh, Shuffle SOAR and IAM for real-time monitoring, threat detection and automated incident response. The goal is to build a secure, functional and well-documented SOC environment. Here’s what I can provide: AWS security monitoring with IAM, CloudWatch/log integrations and secure infrastructure configuration Wazuh + Shuffle SOAR integration with automated playbooks for brute-force, suspicious IAM activity and network threats Threat-intelligence integration, real-time notifications and a dashboard for alerts and incidents I bring over 4+ years of experience in Linux, AWS, cloud infrastructure, automation, web security and technical documentation, with a strong focus on secure and reliable implementations. Just to clarify a few things: Do you already have an existing AWS/Wazuh/Shuffle environment that needs improvement, or should I build it from scratch? Which threat-intelligence sources and dashboard stack are currently preferred? I can also troubleshoot and optimize the existing setup while providing complete deployment and operational documentation. Please come to the chat box to discuss more about your project. Best regards Indresh Kushwaha

@michela542

Hi, I have experience building cloud security and automation systems involving AWS, IAM, Python, Docker, APIs, logging, monitoring, threat analysis and event-driven workflows. ? The key challenge is connecting detection to response reliably. I would structure the SOC so Wazuh detects and normalizes security events, Shuffle orchestrates response playbooks, AWS IAM and CloudTrail provide identity/activity evidence, and every automated action is logged and auditable. ✅ AWS & Wazuh System: I can configure Wazuh for AWS resource monitoring, CloudTrail/IAM events, authentication failures, suspicious activity and endpoint/security telemetry, with appropriate AWS IAM roles and least-privilege permissions. ✅ Shuffle & Incident Response: I’ll create controlled SOAR workflows for brute-force attempts, unauthorized IAM activity, malware/ransomware indicators and suspicious network activity, integrating threat-intelligence lookups for IP reputation and enrichment before response actions. ✅ Dashboard & Operations: I can build a practical SOC dashboard showing alert severity, source, affected resource, status and incident history, with real-time notifications and clear escalation paths. I’ll also troubleshoot the existing infrastructure, optimize noisy detections and document the complete setup. I’ll deliver a functional AWS lab with reproducible configuration, security best practices, playbooks, testing scenarios and complete technical documentation. Best regards, Michel.

@Pearsystemtech

Hi, Pear System can help build and optimize your cloud-based SOC home lab with AWS, Wazuh, Shuffle SOAR and IAM, creating a practical environment for monitoring, detection and automated incident response. We can deliver: • AWS-based SOC infrastructure and security monitoring • Wazuh deployment, agents, rules and threat detection • Shuffle SOAR workflows and automated response playbooks • AWS IAM, least-privilege roles and access controls • Monitoring for AWS resources and suspicious activity • Threat intelligence/IP reputation integrations • SOC dashboard for alerts, incidents and activity • Real-time security notifications • Detection/response workflows for brute force, IAM abuse, malware/ransomware and network anomalies • Infrastructure troubleshooting, hardening and optimization • Complete setup documentation and operational runbook Recommended stack: AWS + Wazuh + Shuffle SOAR + IAM + CloudWatch + Python/REST APIs + Docker + OpenSearch. Our approach: Infrastructure audit → AWS hardening → Wazuh → SOAR → Threat Intel → Dashboard → Response testing → Documentation. Pear System follows security best practices with clear, reproducible configurations and milestone-based delivery. Best Regards, Pear System

@madanvansh1996

Hello, **I can transform your AWS SOC home lab into a realistic, automated security operations environment where threats are detected, enriched, investigated, and responded to automatically.** I’m an experienced DevOps/Cloud & Security professional with hands-on expertise in **AWS, IAM, Linux, Docker, automation, monitoring and security infrastructure**. I can build and optimize: • AWS security architecture with **IAM, CloudTrail, GuardDuty and CloudWatch** • **Wazuh SIEM** for endpoint monitoring, log analysis and threat detection • **Shuffle SOAR** for automated investigation and incident response • Threat-intelligence integration for IP reputation and IOC enrichment • Automated playbooks for **brute-force attacks, unauthorized IAM activity, malware/ransomware and suspicious network activity** • Real-time alerting and notification workflows • SOC dashboard for centralized alert and incident visibility • Infrastructure hardening, troubleshooting and performance optimization • Complete technical documentation, architecture diagrams and setup instructions I’ll also review your existing **GitHub repository**, understand the current implementation, identify gaps, and improve it without unnecessary rebuilding. My focus is to deliver a **functional, secure, automated and reproducible SOC lab** that demonstrates realistic detection and response workflows and can be easily extended in the future. **Available to start immediately.**

@prabinattupurath

Hi, I reviewed your cloud-soc-aws repository and the current SOC implementation before applying. You already have a solid working foundation, so I would focus on improving and hardening the existing environment rather than rebuilding it. I work as a Systems Engineer with hands-on experience in AWS/Linux infrastructure, monitoring, security tooling, automation, networking, alerting, and incident-response workflows. I can help with: Reviewing and hardening the current AWS/SOC architecture Tuning Wazuh and Suricata rules to reduce alert noise Enabling and validating vulnerability detection Adding AbuseIPDB or similar threat-intelligence sources Improving Shuffle incident-response playbooks Adding response paths for brute force, suspicious IAM activity, malware, and network anomalies Improving AWS IAM monitoring and detections Monitoring the Shuffle/TheHive infrastructure itself Improving escalation logic between alerts and confirmed incidents Testing workflows end-to-end and documenting the results I would first audit the existing configuration and playbooks, identify gaps, and improve the environment incrementally without disrupting what is already working.

@jcoopert

Hi there, I reviewed your requirements and the GitHub link. Building a Cloud-Based SOC Home Lab with Wazuh and Shuffle SOAR on AWS requires precise IAM policies and well-structured incident response playbooks. As a Senior Systems Engineer with strong expertise in AWS infrastructure and currently advancing in ISO/IEC 27001:2022 internal auditing standards, I can architect and troubleshoot this lab to professional, enterprise-grade levels. Here is how I will approach your SOC Lab: AWS Infrastructure & IAM: Implement strict least-privilege AWS IAM roles for the lab components to ensure secure interaction between Wazuh, AWS services, and Shuffle SOAR. Wazuh & Shuffle Integration: Seamlessly connect Wazuh alerts to Shuffle SOAR to trigger automated playbooks. Incident Response Workflows: I will configure and validate the specific playbooks you requested (Brute-force mitigation, Unauthorized IAM alerts, Malware isolation, and suspicious network activity). Dashboard & Documentation: Ensure the SOC dashboard is fully functional for visualization and provide you with clear, step-by-step setup instructions so you can defend and present the architecture confidently. I am ready to review your current AWS setup and GitHub repo to start optimizing immediately. Let's connect. Best regards, Jose Rivero

@Akhilay5

Intersted to work..I have exp in pci audit security..lacework alerts handling ..we use tools like lacework integrated to AWS account also gurdduty alerts monitoring and provide resolutions