 SOC.     
 


 SOC                .      Debian 12  Docker     ,    .

  Wazuh, Suricata IDS, DFIR-IRIS, MISP, Velociraptor, Greenbone/OpenVAS,  AI-   Ollama  Qwen, FinCERT IOC Pipeline, WireGuard  Telegram-.    FIM, SCA, Rootcheck,  ,   IOC,   , ,   playbook .

  , , , -,      .    ,  SOC,    ,   ,      SOC.





 

 SOC.     





  5


 5        4.       ,     ,    .




 


 DFIR-IRIS     incident response  TheHive/Cortex;



 Wazuh     4.14.5;



    custom-iris: production filter, contextual assessment, classification, severity, priority, Telegram policy  fail-open dedup;



 SCA   malware/exploitation    Wazuh;



 Rootcheck   host-anomaly,  canonical path  dedup merged-/usr;



    passwd, chfn, chsh  inode, dpkg   ;



   VPS 10.77.77.40  Wazuh Agent vps-telegram-gateway;



  WireGuard, JumpServer  timezone-aware ;



  Greenbone/OpenVAS    vulnerability scanner;       SOC,         IRIS ;



    , bind mount,  jq, restart loop    ;



  playbook- SCA/Rootcheck, - Greenbone   .



         ,    .




  


1. :  ,  IRIS,    ;



2. : Wazuh, Suricata, MISP, Velociraptor, Greenbone  AI   ;



3. : Docker, systemd, , , , backup,   rollback.




 


Health/NOC ->Wazuh/Suricata/Greenbone ->DFIR-IRIS

->IOC enrichment ->endpoint triage ->decision

->remediation ->regression/rescan ->lessons learned




      


          SOC   Debian 12.      ,    :  ,  ,   , ,   .

  -  ,      Suricata,  endpoint-  IDS-   Wazuh,  alerts   DFIR-IRIS, IOC   MISP, endpoint triage   Velociraptor,     Prometheus, Grafana, Blackbox Exporter  SOC Health Lite.




       


   :

 Debian 12    SOC-;



 Docker  Docker Compose   ;



 Wazuh  SIEM/XDR-;



 Suricata  IDS-  ;



 DFIR-IRIS   alerts, cases, tasks, observables, notes  ;



 MISP   Threat Intelligence-;



 Velociraptor  DFIR, endpoint triage  threat hunting;



 Prometheus, Grafana, cAdvisor, Node Exporter  Blackbox Exporter   ;



 Suricata Admin Lite  SOC Health Lite   ;



 FinCERT IOC Pipeline    IOC;



  AI-    ;



 JumpServer  WireGuard    ;



 Greenbone/OpenVAS     .




       .


 SOC-   Ollama  OpenWebUI        .  custom-ai ,       AI-.       SOC-   LLM-.




          


  JumpServer    .     :   , WireGuard-    Wazuh Agents.

      destructive-.  ,  ,  ,  firewall   response-        DFIR-IRIS.




       


1. :  NOC Wallboard,   IRIS   .



2. :  Wazuh, MISP, IRIS modules, Velociraptor  AI   .



3. :  Docker, systemd, , , ,    .



     .       ,   Grafana  ;    ,   .




       


       :

1.         restart loop;



2.       ;



3.   : API , alert , IOC ,    probe  .



docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

docker stats --no-stream

ss -lntp

systemctl --failed




        


     .    :

1. , , link  IP-;



2.   firewall;



3. Docker network  ;



4.    restart count;



5.   bind mount, volume,   ;



6.   ;



7.    .




      


   :



mkdir -p /opt/soc/docs

nano /opt/soc/docs/operations-log.md



   , , , , ,     .




         5


             , production-grade  Wazuh  IRIS,  VPS, Greenbone/OpenVAS,      .      : alert     -  .




 SOC Lab   


SOC Lab     , , Threat Intelligence    .



Endpoint telemetry       ->Wazuh Agent ->Wazuh Manager

Mirrored network traffic ->Suricata ->eve-wazuh.json ->Wazuh Agent

Suricata severity 1      ->Wazuh rule 100601 level 8 ->IRIS / AI

Suricata severity 2      ->Wazuh rule 100602 level 4 ->Wazuh only

IOC archives             ->FinCERT pipeline ->rules / lists / MISP Events

Endpoint triage          ->Velociraptor ->evidence ->IRIS Case

Health monitoring        ->Prometheus / Grafana / Blackbox / Health Lite

Remote agents            ->WireGuard ->Jump ->SOC 10.77.77.30 ->Wazuh

Vulnerability scanning    ->Greenbone/OpenVAS ->autonomous reports / manual transfer



        ,    .         .      . Greenbone/OpenVAS   :      ,     ,      Wazuh        SOC.






.   SOC Lab    .




 SOC Lab  





  .


   .

   ,     (https://www.litres.ru/pages/biblio_book/?art=74222614)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


