SOC Architecture

Kubernetes SOC Lab Architecture

Design the lab namespaces, Wazuh components, storage, access path, monitored workloads, and analyst workflow.

Kubernetes SOC Field Lab · Practical Security Operations

Domain alignment

Platform OperationsSIEM OperationsKubernetes Security

Target architecture

Local Kubernetes cluster
|-- namespace: wazuh
|   |-- Wazuh manager
|   |-- Wazuh indexer
|   |-- Wazuh dashboard
|   |-- services, secrets, config, PVCs
|-- namespace: soc-lab
|   |-- demo workloads and benign test activity
|-- namespace: soc-observer
|   |-- optional toolbox pods
|-- namespace: wazuh-daemonset
    |-- optional Wazuh agent DaemonSet

Why separate namespaces?

Namespace separation makes the lab easier to reason about. The monitoring platform should not be mixed casually with the workloads being monitored. This gives you a practical way to discuss boundaries, access control, cleanup, and troubleshooting scope.

Wazuh components

Wazuh manager: receives and processes security data from agents.
Wazuh indexer: indexes and stores alert data for search and analysis.
Wazuh dashboard: web interface for reviewing alerts.
Wazuh agents: collect telemetry from systems, nodes, workloads, or pods.

Analyst workflow

Generate safe lab event
  ↓
Wazuh collects telemetry
  ↓
Alert appears in dashboard
  ↓
Analyst triages alert
  ↓
Analyst documents finding or tuning note
  ↓
Analyst validates cleanup or remediation

Analyst note: Architecture is part of the investigation. If you do not know where telemetry should come from, you cannot confidently say whether missing data is normal, a blind spot, or a failure.

Check your understanding

Use these questions to check whether the lab and analyst concepts are clear before moving forward.

Why separate the Wazuh namespace from lab workloads?
Which Wazuh component stores searchable alert data?
Which component provides the web UI?
Which component processes agent data?
Why does storage matter for Wazuh?
Why start with port-forwarding in a local lab?
What is the purpose of soc-lab namespace?
What is the purpose of soc-observer namespace?
Why is architecture useful during investigation?
What is a telemetry blind spot?

Answer key

It creates operational boundaries and simpler cleanup/troubleshooting scope.
Wazuh indexer.
Wazuh dashboard.
Wazuh manager.
Stateful components need data to survive pod restarts.
It limits exposure while learning.
It hosts monitored demo workloads and safe test activity.
It can host toolbox or observer pods used for testing.
It tells analysts where data should originate and how components relate.
Activity occurs but is not collected or visible.