The Defense Architecture
In a modern SOC, defense is no longer about watching logs and alerting — it's about automated visibility and response. This project integrates a SIEM, SOAR, and Threat Intelligence platform to transform passive monitoring into an active defense architecture capable of containing attacks within seconds of detection.
The Toolchain
01
Wazuh — Detection & Monitoring
The SIEM/XDR acting as the "eyes" of the SOC. Collects and correlates endpoint logs in real time. SSH brute-force detection via failed login rules; malware detection via File Integrity Monitoring (FIM) on sensitive directories.
02
Shuffle — SOAR Orchestration
The "connective tissue" that automates the workflow. Receives Wazuh alerts via webhook, sends Discord notifications, routes to VirusTotal for enrichment, triggers Active Response, and pushes all data into IRIS for case tracking.
03
VirusTotal — Threat Intelligence
Validates suspicious file hashes against 68 antivirus engines before destructive action is taken. Acts as the "brain" that filters noise — only confirmed threats proceed to Active Response, eliminating false positive containment.
04
Active Response — Automated Containment
Wazuh's built-in response framework executing custom scripts on the endpoint agent. SSH brute-force triggers a stateful firewall block (180-second timeout). Malware triggers
remove-threat.sh which deletes the file before execution.
05
IRIS — Case Management & DFIR
The analyst workspace where all technical details (IPs, hashes, VirusTotal reports, timestamps, agent names) are pushed automatically. Ensures every automated response is documented with a full timeline for post-mortem review.
The Attack Scenarios
Attack 01
SSH Brute Force
Emulated with Infection Monkey. Wazuh fires on Rule ID 5763 (multiple failed logins). Active Response runs
firewall-drop — stateful block on attacker IP for 180 seconds, then auto-lifts to prevent permanent lockout.Attack 02
Malware Download
FIM detects new file in monitored directory. Hash sent to VirusTotal. If flagged malicious, remove-threat.sh executes on the agent and deletes the file. Tested with the EICAR standard test file against
/home/target.
Key Configuration
Wazuh → Shuffle Integration
/var/ossec/etc/ossec.conf
<integration> <name>shuffle</name> <hook_url>http://[SHUFFLE_IP]:3001/api/v1/hooks/[ID]</hook_url> <alert_format>json</alert_format> </integration>
Active Response — Malware Removal Script
remove-threat.sh (excerpt)
#!/bin/bash read INPUT_JSON FILENAME=$(echo "$INPUT_JSON" | jq -r \ '.parameters.alert.data.virustotal.source.file') # Delete before execution rm -f "$FILENAME" echo "$(date) — threat removed: $FILENAME" >> "${LOG_FILE}"
SSH Brute-Force Active Response
ossec.conf — firewall-drop
<active-response> <command>firewall-drop</command> <location>local</location> <rules_id>5763</rules_id> <timeout>180</timeout> </active-response>
Reflection
API integration is the hard part. Getting Wazuh, Shuffle, and IRIS to communicate reliably — especially the IRIS authentication header bug where the ApiKey field didn't work and required a manual Authorization: Bearer header — taught that security engineering is mostly troubleshooting connectivity and data flow, not writing the detection logic itself.
Alert fatigue is real. Using VirusTotal as a validation gate — rather than piping every file change to Discord — demonstrated how to build signal-to-noise filtering into the architecture instead of bolting it on afterward.
Automated defense is faster than any analyst. Watching remove-threat.sh delete malware before it could be clicked proved the core value of closing the loop end-to-end.
01 / 04
Pentest Reporting →