Final Project: Build and Operate a Kubernetes SOC Lab

Complete the Kubernetes SOC Field Lab by documenting platform health, endpoint coverage, safe event tests, alert investigation, detection notes, incident workflow, and cleanup.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

Final project objective

Build, validate, operate, and document a local Kubernetes SOC lab using Wazuh. The final deliverable should prove that the learner can deploy the platform, troubleshoot it, onboard endpoints, generate safe telemetry, investigate alerts, write detection notes, and document response workflow.

Required lab evidence

Platform evidence:
- Wazuh dashboard is reachable
- Wazuh indexer is Running/Ready
- Wazuh manager master is Running/Ready
- Wazuh manager worker is Running/Ready
- PVCs are Bound
- No active CrashLoopBackOff

Endpoint evidence:
- Kubernetes DaemonSet agent active
- Windows host agent active
- Recent keep alive for both endpoints
- Inventory visible for Windows
- Endpoint list screenshot or notes

Required analyst work

Analyst deliverables:
- One Kubernetes visibility test
- One Windows visibility test
- One Wazuh event investigation
- One detection/tuning note
- One incident workflow note
- One cleanup plan

Final report template

Kubernetes SOC Lab Final Report

1. Lab summary
2. Architecture
3. Wazuh deployment notes
4. Troubleshooting performed
5. Endpoint coverage
6. Safe event tests
7. Alert investigation
8. Detection and tuning notes
9. Incident workflow
10. Known limitations
11. Cleanup procedure
12. Lessons learned

Known limitations to document

• This is a local lab, not a production SOC.
• Windows host access may depend on port-forward sessions.
• Kind networking differs from production Kubernetes networking.
• HostPath mounts require careful review outside a lab.
• No alert does not guarantee no activity.
• Default lab credentials and secrets are not production acceptable.

Cleanup procedure

Optional cleanup:
- Stop Windows Wazuh agent service if no longer needed
- Uninstall Windows Wazuh agent if desired
- Delete Wazuh agent DaemonSet
- Delete wazuh-agents namespace
- Delete Wazuh deployment only when done with the lab
- Review PVCs before deleting stateful data

Completion checklist

1. Wazuh deployed on Kubernetes.
2. Storage fixed and PVCs bound.
3. Manager memory fixed and pods stable.
4. Kubernetes DaemonSet agent active.
5. Windows host agent active.
6. Safe events generated.
7. At least one event investigated.
8. Detection/tuning note written.
9. Incident workflow note written.
10. Final report completed.