Case studies
Real problems from building a self-hosted SOC/SOAR, with the root cause and what changed.
- 01
A self-hosted SOC/SOAR on a three-node homelab
The architecture of my Master’s final-year project: what it collects, how it reacts, and the rules it is built on — no public exposure, every change versioned, every claim tested.
- 02
When the SIEM goes blind without a single error
Three silent failures in two days, none raised by the SIEM itself. Tracing them to one root cause, then building a watchdog that would have caught all three.
- 03
Detection as code: versioning a live SIEM ruleset
Putting the Wazuh ruleset under Git without a sync step that can drift, and a non-regression suite built from real log lines — proven by a negative control that brings an old bug back.
- 04
Automatic IP blocking without giving the SIEM the keys to the firewall
A critical IDS alert bans the attacker at the firewall within seconds, for ten minutes. The interesting part is what the SIEM is not allowed to do, and two bugs that only a real end-to-end test revealed.
- 05
Letting AI agents operate a homelab, under control
LLM agents that can query the SIEM and manage containers from my phone — confined by three independent layers of permissions. And the day one agent tried to work around a missing tool, which showed what the SIEM could not yet see.