Enterprise SOC lab: Proxmox, pfSense, and ELK with Suricata

A virtual enterprise SOC built from the ground up on Proxmox VE, closer to a small production network than a single-box demo lab.

Infrastructure

Active Directory for identity, pfSense doing VLAN segmentation between network zones, and an ELK stack wired to Suricata IDS for live packet inspection.

What it’s for

Suricata feeds traffic alerts into ELK alongside system and security logs, so the lab supports real hunting and log analysis across a segmented network instead of a flat one. That segmentation is the part that’s closer to what a real environment actually looks like.

Full setup and configs are in the repo linked above.