Virtualisation host
Self-built Proxmox server
- Intel Xeon E5-2648L
- 32 GB RAM
- 2 TB SATA SSD
- Proxmox virtualisation
01 / The foundation
Local compute. Cloud integration.
Each part of the environment has a distinct role: hosting lab machines, running models locally, or providing cloud security telemetry.
Local inference
Windows workstation
- AMD Ryzen 7 5800X
- 64 GB RAM
- Radeon RX 7600 XT / 16 GB VRAM
- Ollama serving local Qwen models
Cloud services
Azure
Microsoft Sentinel and Log Analytics provide telemetry for the SOC projects. This website is hosted separately in Azure Blob Storage and delivered through Azure Front Door.
SOC project / Component relationships
Proxmox / Ubuntu VMDocker hosts n8n orchestration and the Azure MCP service.
Windows / Ollaman8n calls the local model for summaries and investigation reasoning.
Azure / SentinelThe MCP service provides authenticated access to Log Analytics queries.
n8n coordinates the workflow, Ollama supplies local inference, and Azure MCP connects the investigation to Sentinel telemetry.
02 / Tools and test systems
The virtual lab
A collection of monitoring, analysis, and target systems supports practical security exercises.
Monitoring & automation
QRadar + Ubuntu Docker VM
QRadar supports log ingestion, parser development, and detection testing. The Ubuntu Docker VM hosts services used in the automation projects, including n8n and Azure MCP.
Malware analysis
FLARE-VM + REMnux
Windows and Linux analysis environments for examining suspicious files and developing practical malware-analysis skills.
Testing & investigation
Kali Linux
A dedicated VM for security testing and generating controlled activity to investigate in the lab's monitoring tools.
Windows environment
Domain controller, client & IIS
A Windows domain controller and client provide a domain environment for lab exercises. A separate standalone IIS server supports web-server testing and process-telemetry investigations.
03 / Documenting the work
Build logs & practical guides
The configuration work behind the lab, from deploying a SIEM appliance to turning raw firewall logs into useful security events.
Infrastructure / QRadar CE 7.3.3
Installing QRadar on Proxmox
Importing the appliance disk, configuring the VM, and documenting logging and auto-update troubleshooting.
Log engineering / pfSense
Building a custom pfSense DSM
Taking raw filterlog syslog through event identification, QRadar mappings, and normalised network-property extraction.
Security tooling / Local AI
RedAmon on Proxmox
Deploying RedAmon with a separate Ollama inference host, validating initial reconnaissance, and tracing an unresolved AI Agent tool-selection failure. The write-up distinguishes working deployment and recon from unverified agent execution.
For forensic investigations and detection-validation reports, explore the technical field notes.
04 / Security automation
Building towards an agentic SOC
A series of projects exploring local inference, workflow orchestration, and access to real security telemetry. The first project is a news briefing pipeline; the later projects focus on Sentinel investigations.
Stage 1 / Local AI briefing
From RSS to a SOC-oriented briefing
n8n retrieves security news, passes source material to a local Ollama model, and delivers summaries through Telegram. This project established the local inference and automation foundations.
Stage 2 / Tool integration
Connecting Azure MCP
An authenticated MCP service connects the n8n agent to Azure, enabling real Log Analytics queries against Sentinel telemetry.
Stage 3 / Investigation proof of concept
Investigating Sentinel incidents
A locally hosted agent queries Cowrie honeypot telemetry through MCP and delivers an investigation report to Discord. The write-up records the demonstrated workflow and its evidence-validation limitations.
Stage 4 / Incident looping & history
Stateful, multi-incident processing
The workflow investigates incidents sequentially, skips those already recorded in a persistent processing history, and aggregates Discord message responses before writing one completion record per incident. Execution remains on demand; automatic scheduling is deliberately deferred.
05 / Where it started
The website moved. The lab kept growing.
Raspberry Pi→Proxmox→Azure
This website began on a Raspberry Pi, later moved onto the Proxmox server, and is now hosted in Azure. The homelab remains the environment behind the experiments and projects documented here.