MCP investigation path
Six bounded tools retrieve approved Wazuh health, agent, rule, alert and vulnerability information. They cannot enroll agents, change configurations, write to indexes or trigger responses.
05 / SOC HOME LAB
SOC HOME LAB ARCHITECTURE
Virtualized security operations environment with controlled detection, investigation and alert intake.
Sanitized alert path
Only high-severity lab alerts pass through a fixed allowlist. The workflow keeps the IRIS API key in protected storage and creates alerts—not cases or endpoint actions.
Reboot-safe lab stack
Wazuh MCP, Wazuh services, Shuffle, DFIR-IRIS and the private relay are configured to recover after normal service or host restarts.
VALIDATION
End-to-end alert automation confirmed.
A controlled Wazuh event completed the full sanitized route through Shuffle and created a DFIR-IRIS alert over certificate-verified HTTPS.
NEXT
→