How to Build a Home SOC Lab with Free Tools

Job adverts for SOC roles ask for hands-on experience with a SIEM and endpoint logs, but most entry level candidates have only read about them. A small home lab closes that gap: you generate real events, search them, write a detection and explain what you found. This guide walks you through a lab you can build on one computer with free software.

Decide what your lab needs to prove

Before you download anything, decide what skills you want to show. A lab that tries to copy an enterprise network on day one usually ends up half built. Start small and add pieces once each one works.

Level 2 is the sweet spot for most people applying for their first SOC role. It gives you a full loop: activity happens, logs are collected, you detect it and you write it up.

Plan the hosts and keep the network isolated

Use a free hypervisor such as VirtualBox, or Hyper-V if you are on Windows Pro or Enterprise. You need two virtual machines for a Level 2 lab:

• Windows client: Microsoft offers a Windows 11 Enterprise evaluation that runs for 90 days. Name it something like WS-114 so your notes read like real tickets.
• SIEM server: an Ubuntu Server VM for Wazuh, or your host machine or a Windows VM for Splunk Enterprise under the Free licence.

If you later add a domain controller, the Windows Server evaluation runs for 180 days. Take a snapshot of every VM once it is configured so you can roll back after tests instead of rebuilding.

Install Sysmon on the Windows endpoint

Default Windows logging misses a lot of what analysts need, such as full process command lines with hashes and parent processes. Sysmon, a free Microsoft Sysinternals tool, adds that detail to the Microsoft-Windows-Sysmon/Operational event log. Do not run it without a configuration file: start from a well known community config such as SwiftOnSecurity's sysmon-config or Olaf Hartong's sysmon-modular, then adjust it later.

sysmon64.exe -accepteula -i sysmonconfig.xml

rem Confirm the service is running
sc query sysmon64

Then check that events are arriving. This PowerShell command shows the five most recent process creation events.

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Sysmon/Operational'
    Id      = 1
} -MaxEvents 5 | Format-List TimeCreated, Message

Choose a free SIEM and forward the logs

You do not need an enterprise licence to practise searching. Pick one SIEM, get it working, and only then try a second.

For Splunk, install the Universal Forwarder on WS-114 and add an input for the Sysmon log. Create an index called sysmon on the Splunk server first, and install the Splunk Add-on for Sysmon so fields such as Image, CommandLine and ParentImage are extracted.

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = 0
renderXml = true
index = sysmon

Generate safe test activity and detect it

Atomic Red Team is an open source library of small, documented tests mapped to MITRE ATT&CK techniques. It exists so defenders can check whether their logging and detections work. Use it only inside your isolated lab, read each test before you run it, and clean up afterwards.

A safe first choice is discovery: commands an attacker runs to learn who they are and what accounts exist. These map to T1033 System Owner/User Discovery and T1087.001 Account Discovery: Local Account. With the Invoke-AtomicRedTeam PowerShell module installed, you can read a test's details before you run anything:

# Review what the tests for this technique do
Invoke-AtomicTest T1033 -ShowDetailsBrief

# Check and install prerequisites, run test 1, then clean up
Invoke-AtomicTest T1033 -TestNumbers 1 -GetPrereqs
Invoke-AtomicTest T1033 -TestNumbers 1
Invoke-AtomicTest T1033 -TestNumbers 1 -Cleanup

Now search for what happened. This search finds common discovery tools in Sysmon process creation events and groups them by host, user and parent process.

index=sysmon EventCode=1
    (Image="*\\whoami.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\quser.exe")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as commands
        by host User ParentImage
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Look closely at ParentImage. On a real network, an administrator running whoami from cmd.exe is normal. The same command spawned by winword.exe or w3wp.exe is not. Run the same search before and after your test so you learn what your own baseline looks like.

Turn your lab into career evidence

A lab only helps your job search if someone can see what you learned. Write up each exercise as if it were a short incident ticket.

• State the technique and its ATT&CK ID, and what you expected to see.
• Include the exact query, a screenshot of the results and the key fields that mattered.
• Explain what normal looks like and what would make you escalate.
• Note false positives you found and how you would tune them.
• Publish the write ups on a blog or a public repository, with no personal or employer data.
• Rebuild one piece from scratch after a month to prove you can do it without notes.

Five clear write ups covering different techniques are worth more than a complicated lab you cannot explain. In interviews, be honest that it is a home lab. Hiring managers care that you understand the logs and can reason about them, not that the environment was large.

Key takeaways

Pick one technique this weekend, run it in your lab, find it in your logs and write a one page summary. Repeat that loop every week and within a couple of months you will have a portfolio that shows exactly how you work on shift.