Listen to this Post
Introduction:
The democratization of security operations has reached an inflection point where a $35 single-board computer, paired with open-source tooling, can now emulate the core capabilities of a multi-million-dollar Security Operations Center (SOC). By containerizing Wazuh for SIEM/XDR functionality, Suricata for network intrusion detection, and Grafana with Prometheus for full-stack observability, security practitioners can build production-grade threat detection pipelines that scale from homelab experiments to enterprise edge deployments. This article dissects the architecture, deployment procedures, and operational nuances of a self-hosted SOC stack on Ubuntu Server with Raspberry Pi infrastructure, providing verified commands and configuration snippets for Linux, Windows, and containerized environments.
Learning Objectives:
- Deploy and configure a complete SOC stack using Docker containers on Ubuntu Server, integrating Wazuh, Suricata, Grafana, and Prometheus for unified threat detection and monitoring.
- Implement encrypted remote access and zero-trust networking using Tailscale, with alternative considerations for Cloudflare Tunnel + WARP for self-hosted VPN replacement.
- Establish automated resilience through robust backup protocols, system monitoring, and observability pipelines across the entire security infrastructure.
- Extend the SOC with Identity and Access Management (IAM) using Authentik and IP Address Management (IPAM) with NetBox for enterprise-grade operational maturity.
- Core SIEM and XDR Deployment: Wazuh on Docker
Wazuh serves as the brain of this SOC architecture, providing log collection, analysis, file integrity monitoring (FIM), vulnerability detection, and real-time alerting. The containerized deployment approach ensures portability and simplifies maintenance across Raspberry Pi and Ubuntu environments.
Step‑by‑step guide:
Begin by preparing your Ubuntu Server (22.04 LTS or 24.04 LTS recommended) with Docker and Docker Compose. Install Docker using the official repository for security and stability:
sudo apt update && sudo apt install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg sudo chmod a+r /etc/apt/keyrings/docker.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null sudo apt update sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
For a rapid all-in-one Wazuh deployment, use the official installation script:
curl -s https://packages.wazuh.com/4.x/wazuh-install.sh | bash
This script installs the Wazuh manager, indexer, and dashboard in a single-1ode configuration. For Docker-based deployments, leverage community-maintained Compose files that orchestrate Wazuh alongside Elasticsearch and Kibana:
git clone https://github.com/CatherineChen-CyberSecurity/wazuh-suricata-elk-docker.git cd wazuh-suricata-elk-docker sudo make setup sudo make deploy
The deployment automatically detects network interfaces, generates Suricata configuration, and starts all necessary containers. Access the Wazuh dashboard at `https://localhost/app/wz-home` after deployment completes.
2. Network Intrusion Detection: Suricata Integration
Suricata provides network-based threat detection, analyzing traffic patterns for malicious activity, port scans, and brute-force attempts. Integration with Wazuh transforms raw network events into actionable security alerts.
Step‑by‑step guide:
Install Suricata on the same Ubuntu host or within a dedicated container. For host-based installation:
sudo add-apt-repository ppa:oisf/suricata-stable -y sudo apt update sudo apt install suricata -y
Configure Suricata to output EVE JSON logs, which Wazuh can ingest for correlation. Edit /etc/suricata/suricata.yaml:
outputs: - eve-log: enabled: yes filetype: regular filename: eve.json types: - alert - http - dns - tls
Start Suricata and verify its operation:
sudo systemctl enable suricata sudo systemctl start suricata sudo tail -f /var/log/suricata/eve.json
To integrate Suricata logs into Wazuh, configure local log collection in /var/ossec/etc/ossec.conf:
<localfile> <log_format>json</log_format> <location>/var/log/suricata/eve.json</location> </localfile>
Restart the Wazuh manager to apply changes:
sudo systemctl restart wazuh-manager
For Dockerized Suricata, the `wazuh-suricata-elk-docker` repository provides a pre-configured container that automatically bridges to the Wazuh manager.
3. Observability and Monitoring: Grafana with Prometheus
Prometheus collects time-series metrics from the entire stack, while Grafana transforms those metrics into actionable dashboards for continuous observability. Together, they provide visibility into system health, container resource usage, and security telemetry.
Step‑by‑step guide:
Deploy the complete monitoring stack using Docker Compose:
sudo mkdir -p /opt/monitoring-demo cd /opt/monitoring-demo
Create `docker-compose.yml` with Prometheus, Grafana, and cAdvisor for container metrics:
services: prometheus: image: prom/prometheus:latest container_name: prometheus ports: - "9090:9090" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml - prometheus_data:/prometheus command: - '--config.file=/etc/prometheus/prometheus.yml' - '--web.enable-lifecycle' restart: always grafana: image: grafana/grafana:latest container_name: grafana ports: - "3000:3000" volumes: - grafana_data:/var/lib/grafana environment: - GF_SECURITY_ADMIN_PASSWORD=admin restart: always cadvisor: image: gcr.io/cadvisor/cadvisor:latest container_name: cadvisor privileged: true ports: - "8080:8080" volumes: - /:/rootfs:ro - /var/run:/var/run:ro - /sys:/sys:ro - /var/lib/docker/:/var/lib/docker:ro restart: always volumes: prometheus_data: grafana_data:
Create `prometheus.yml` to scrape metrics from cAdvisor and the host:
global: scrape_interval: 15s scrape_configs: - job_name: 'cadvisor' static_configs: - targets: ['cadvisor:8080'] <ul> <li>job_name: 'node' static_configs:</li> <li>targets: ['host.docker.internal:9100']
Launch the stack:
docker compose up -d
Access Grafana at http://localhost:3000` (default credentials:admin/admin). Add Prometheus as a data source by navigating to Connections → Data Sources → Add data source, and enterhttp://prometheus:9090`. Import a pre-built dashboard (e.g., ID 1860 for node monitoring) to visualize system metrics instantly.
4. Encrypted Remote Access: Tailscale Mesh VPN
Tailscale provides zero-configuration encrypted remote access, building on WireGuard to create a secure mesh network without manual key management or complex firewall rules. This enables secure SOC management from anywhere without exposing services to the public internet.
Step‑by‑step guide:
Install Tailscale on your Ubuntu server using the official one-line script:
curl -fsSL https://tailscale.com/install.sh | sh
Authenticate and connect to your tailnet:
sudo tailscale up
Follow the authentication URL to log in with your identity provider (Google, GitHub, Azure AD, etc.). After authentication, verify your Tailscale IP:
tailscale ip -4
To secure the server, configure UFW to accept connections only from the Tailscale network:
sudo ufw allow from 100.64.0.0/10 to any port 22 proto tcp sudo ufw allow from 100.64.0.0/10 to any port 443 proto tcp sudo ufw enable
Now SSH into your server using its Tailscale IP instead of the public address:
ssh username@<tailscale-ip>
For organizations seeking a fully self-hosted alternative, Cloudflare Tunnel with WARP provides similar capabilities without reliance on Tailscale’s cloud coordination servers. Install `cloudflared` and create a tunnel:
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-archive-keyring.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list sudo apt update && sudo apt install cloudflared cloudflared tunnel create <tunnel-1ame> cloudflared tunnel route dns <tunnel-1ame> <subdomain.domain.com> cloudflared tunnel run <tunnel-1ame>
5. Identity and Access Management: Authentik Integration
As the SOC scales, centralized authentication becomes essential. Authentik provides open-source SSO with support for SAML, OAuth2/OIDC, and LDAP, enabling unified access control across all services.
Step‑by‑step guide:
Deploy Authentik using Docker Compose:
git clone https://github.com/AiratTop/authentik-self-hosted.git cd authentik-self-hosted
Create a shared Docker network and configure environment variables:
docker network create shared_network
Create a `.env` file with required secrets:
PSQL_PWD=<strong-database-password> AUTHENTIK_SECRET_KEY=<long-random-secret-string>
Start the services:
docker compose up -d
Access the initial setup at `http://localhost:9000/if/flow/initial-setup/` and set a password for the `akadmin` user. After initial configuration, integrate Authentik with Wazuh, Grafana, and other SOC components using OAuth2 or LDAP. For Active Directory environments, Authentik supports LDAP integration and password writeback.
6. Infrastructure Management: NetBox for IPAM
NetBox serves as the single source of truth (SSOT) for network infrastructure, providing IP address management (IPAM), device tracking, and topology visualization. This is essential for maintaining operational visibility as the SOC expands.
Step‑by‑step guide:
Deploy NetBox using Docker Compose:
git clone -b release https://github.com/netbox-community/netbox-docker.git cd netbox-docker
Copy the environment template and configure:
cp env.example .env
Edit `.env` to set SUPERUSER_EMAIL, SUPERUSER_PASSWORD, and ALLOWED_HOSTS. Launch NetBox:
docker compose up -d
Access the NetBox web interface at `http://localhost:8080`. Use the REST API for automated IP allocation and infrastructure documentation:
curl -X GET http://localhost:8080/api/ipam/prefixes/ -H "Authorization: Token <your-api-token>"
NetBox’s GraphQL and REST APIs enable integration with Ansible and Terraform for infrastructure-as-code workflows.
7. Automated Resilience and Backup Protocols
Robust backup protocols ensure business continuity and data integrity across the SOC stack. Implement automated backups for Wazuh indices, Grafana dashboards, and PostgreSQL databases.
Step‑by‑step guide:
For Wazuh, schedule Elasticsearch snapshot backups:
curl -X PUT "localhost:9200/_snapshot/backup_repo" -H 'Content-Type: application/json' -d'
{
"type": "fs",
"settings": {
"location": "/mnt/backups/elasticsearch"
}
}'
Create a cron job for daily snapshots:
0 2 curl -X PUT "localhost:9200/<em>snapshot/backup_repo/snapshot</em>$(date +\%Y\%m\%d)"
For Grafana, export dashboards via the API or use the provisioning system with version-controlled JSON files. For Authentik, use the provided backup script:
./backup.sh
This creates a compressed PostgreSQL backup. Store backups off-site using `rsync` or cloud storage:
rsync -avz /var/backups/ user@remote-backup-server:/backups/soc/
What Undercode Say:
- Key Takeaway 1: Containerization transforms SOC deployment from a months-long infrastructure project into a weekend homelab exercise, but production-grade implementations demand careful attention to network segmentation, secrets management, and backup strategies. The same Docker Compose patterns that enable rapid prototyping can scale to enterprise edge deployments with proper orchestration.
-
Key Takeaway 2: The debate between Tailscale and Cloudflare Tunnel reflects a broader architectural tension—control versus convenience. Tailscale offers seamless mesh networking with minimal configuration, while Cloudflare’s WARP + Tunnel provides a fully self-hosted alternative that keeps all traffic within your infrastructure. The choice depends on threat model and compliance requirements, not technical capability.
-
Key Takeaway 3: Threat intelligence integration elevates a basic SIEM from reactive log aggregation to proactive threat hunting. Enriching Wazuh alerts with VirusTotal, MISP, or OpenCTI feeds automates IOC validation and reduces mean time to detection (MTTD). The MITRE ATT&CK framework provides the common language for mapping detections to adversary behaviors, enabling security teams to prioritize responses based on real-world threat actor TTPs.
-
Key Takeaway 4: Observability is not optional—it is the foundation of incident response. Prometheus and Grafana provide the telemetry layer that answers “what changed?” during an investigation. Without metrics on system state before, during, and after an attack, root cause analysis becomes guesswork. The monitoring stack must be treated as a first-class citizen, not an afterthought.
-
Key Takeaway 5: The SOC stack is never truly “complete.” As the infrastructure evolves, so must the security controls. Authentik addresses the identity crisis that emerges when multiple services require authentication; NetBox solves the documentation debt that accumulates when IP allocations are tracked in spreadsheets. These adjacent tools transform a security lab into an operational platform, bridging the gap between defensive technology and enterprise IT governance.
Prediction:
+1 The commoditization of SOC tooling through open-source projects and containerization will continue to lower barriers to entry, enabling small teams and individual practitioners to build enterprise-grade security operations capabilities. This democratization will drive innovation in threat detection and incident response as diverse perspectives enter the field.
+1 The convergence of SIEM, XDR, and observability platforms into unified data lakes will accelerate, with Wazuh and Elasticsearch leading the open-source charge. Organizations will increasingly adopt composable security architectures over monolithic commercial suites, prioritizing flexibility and vendor independence.
-1 The complexity of managing a DIY SOC stack introduces significant operational risk. Misconfigured containers, exposed dashboards, and inadequate backup strategies can create more vulnerabilities than they mitigate. Organizations must invest in disciplined DevSecOps practices to realize the benefits of open-source security tooling.
-1 As more homelab SOCs transition to production, the shortage of practitioners with cross-functional skills—spanning Linux administration, container orchestration, threat intelligence, and incident response—will become acute. Training programs must evolve to address this multi-disciplinary requirement, or the talent gap will widen further.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Alexanderdailey I – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
