Building an AI-Powered SOC Lab: Architecture & Setup (Part 1)
I’ve been getting rather scared of the life of a SOC analyst. The logs, the alerts, the constant digging through noise trying to find what actually matters. That process seems exhausting and honestly unsustainable at scale. I think there should be a better way to speed things up, and that’s the whole point of this lab series.
So what we’re building here is a lab where Wazuh catches the threats, and instead of you manually hunting through alerts, an AI agent in n8n does the first pass for you. It queries the logs, makes sense of them, and tells you what’s worth your attention. Less manual digging, more actual security work.
This is a 3 part series. Part 1 covers the architecture and getting everything set up. Part 2 is where Atomic Red Team goes live and we see what Wazuh actually catches. Part 3 is where we bring in n8n and build the AI triage layer on top of it all.
This first part is just getting everything stood up. No attacks yet, no automation. The architecture and setting up our environment. Just the foundation.
Here’s the stack we’re working with:
- Wazuh - is the SIEM. It runs as three Docker containers: the manager, the indexer, and the dashboard.
- n8n - is the automation layer. It’s what turns Wazuh from a detection tool into something that actually responds and reports intelligently.
- Docker - is just how everything runs. One network, everything talking to each other cleanly.
- Auditd - fills the gap the Wazuh agent can’t. The agent lives in userland so it misses a lot of low level kernel activity. auditd logs at a deeper level and feeds that into Wazuh so nothing slips through.
- Atomic Redteam - is the attacker. A repo from Red Canary that simulates real adversary techniques. It’s what generates the malicious traffic we’re detecting.
- Postman - is how we explore the Wazuh APIs before touching n8n. We use it to understand what data we’re working with and how to query it, then map that over to n8n once we know what we’re doing.
- Ubuntu machine (or any OS of choice)
The Architecture
So looking at the diagram, everything is running on one Ubuntu machine. That’s our lab environment.
Inside that machine we have a Docker network, soc-net, and that’s where the Wazuh stack lives. Three containers: the manager which is basically the brain of the whole operation, the indexer which is just storing everything coming in, and the dashboard which is how we actually look at the data.
Now outside of Docker but still on the same Ubuntu machine we have our auditd, Atomic Red Team, and the Wazuh agent. These three are doing the heavy lifting on the attack side.
Now, the Atomic Red Team fires off attack simulations. auditd catches all of that at a really deep level, stuff the Wazuh agent alone would miss. The agent then takes those logs and ships them straight to the manager.
From there the data hits the indexer and now it’s queryable. n8n lives inside the same Docker network so it can reach the Wazuh APIs directly. It pulls the alerts, sends them to an LLM, and whatever the LLM figures out gets sent back to you.
So at the end of the day we’re sitting in front of two things: the Wazuh dashboard showing you what got detected, and n8n telling us what actually matters.
So at the end of the day the whole environment is wired up and ready. Next up we start making noise, Atomic Red Team goes live and we see exactly what Wazuh catches.
But before any of that, we need to actually build the thing.
We’re starting with Docker and the Wazuh containers. Now I’m not going to have you set all of this up from scratch because honestly that’s a lot of unnecessary work. There’s a repo that comes with everything prepackaged, all the containers, the configs, the network setup. We’re just going to clone it and and we’re good to go.
After that we’re getting auditd installed and configured on the Ubuntu machine. This part is important, we want to make sure it’s actually capturing the right stuff before Atomic Red Team starts running anything.
The Setup
To begin our setup we first have to install Git and Docker on our Ubuntu machine. Git is purely for pulling the repo from GitHub and Docker, well we already covered that.
To install Git run:
sudo apt install git
After that we pull the repo from GitHub. You can find the full repo here: wazuh-n8n-lab-setup by Atlantium-AI.
Clone it with:
git clone https://github.com/Atlantium-AI/wazuh-n8n-lab-setup.git
From the image above we can see the pull was successful.
Next is Docker. Change into the repo directory that was just pulled.
Then run:
sudo ./install-docker.shThis command basically executes the shell script named install-docker.sh located in the current directory.
If this appears on your terminal, then its setting up quite nicely.
We’re halfway there.
Once it’s done you’ll get this on your screen.
One thing to note, make sure to exit out of the root user with the exit keyword so you're back on your regular user terminal.
You can confirm Docker is installed by running:
docker --versionSpinning Up the Containers
Now let’s spin everything up:
sudo ./docker-spin-up.shThis runs the docker-spin-up.sh script which starts Docker and brings up all our containers: the Wazuh manager, indexer, dashboard, and n8n.
If you want to peek at what the script is actually doing, open it with nano.
So from what’s shown, it installs a few prerequisites, sets up the Docker network, tweaks some kernel settings for OpenSearch, and pulls the right version of the Wazuh Docker repo. It also generates certificates if they’re not already there and checks for existing containers before moving on.
There’s still more to the script beyond this part, but this is just the initial setup phase.
Leave it to run uninterrupted. It might take a while but once it’s done you’ll see a confirmation on screen.
If you see thid then you have evrrything set up. Lets chevk if everything in ur containers is running.
Get Augustine Ubong Sito’s stories in your inbox
Join Medium for free to get updates from this writer.
To verify all your containers are running, run:
sudo docker ps
This shows you all four containers alongside the port numbers you’ll use to access each service.
Open Firefox on your Ubuntu machine and go to:
https://localhostBefore logging in we need to grab the credentials. Run these commands:
cd wazuh-docker
ls
cd single-node
ls
cat docker-compose.ymlScroll until you find the wazuh-dashboard section. It should look like the image below.
Your username and password will be right there. You can change them from the portal later but for this lab it’s not a concern.
Head back to the browser, you’ll get a security warning. Just hit advance and accept the risk. After that you’ll land on the login screen. Put in the credentials and you’re in.
Adding the Agent
Next we add the Wazuh agent and we’re using the same Ubuntu machine as the host. Normally this would be a problem but since the manager is running inside Docker it’s completely fine. If the manager wasn’t containerized this wouldn’t work. You’d rather need another endpoint
To add the agent, click on Deploy new agent in the dashboard.
For the server address, for the Wazuh agent we’re using the loopback address 127.0.0.1 as the server address instead of the Ubuntu machine’s actual IP. The reason for that is pretty simple. The agent and the manager are both on the same machine and the manager is running inside Docker on that same host. So there’s no need to go out to the network and come back in. The loopback just keeps everything local and direct. Using the machine’s actual IP here could also cause routing issues depending on how your network interfaces are set up so the loopback is just the cleaner option for this kind of setup.
Give your agent a name, then copy the install command the dashboard generates and run it in your terminal. It won’t take long. Once it’s done you’ll see the commands to start the daemon at the bottom of the screen. Copy and run those too.
Your agent is now up and running.
Setting up n8n
To set up n8n we need to log in. First confirm the port n8n is running on:
sudo docker ps
The port for n8n is 5678. Head to your Firefox browser and enter:
http://loaclhost:5678Make sure it’s http and not https, that’s important for this lab.
You’ll be met with a create account screen. Go ahead and set up your account with credentials of your choice.
When prompted, skip the free license key option and just hit Skip.
If you see the welcome screen you’re all set.
Auditd Installation
Next we install auditd and get it configured. Run:
sudo apt install -y auditd audispd-pluginsThen once that runs. Run this command to enable it so it starts on boot:
sudo systemctl enable --now auditd
Confirm it’s running with:
sudo systemctl status auditd --no-pager
Now we need to tell Wazuh about auditd by editing the config file:
Run this command:
sudo nano /var/ossec/etc/ossec.confScroll to the bottom and add this block:
<localfile>
<log_format>audit</log_format>
<location>/var/log/audit/audit.log</location>
</localfile>So it looks like this below.
After this is done, go ahead and restart your agent:
sudo systemctl restart wazuh-agentPostman Installation
Postman is an API testing tool. In this context we’re using it to talk directly to the Wazuh containers and see what kind of data they return before we build anything in n8n. Think of it as a way to figure out your API calls first, understand the responses, and make sure you’re pulling the right data. Once that’s sorted, moving it all into n8n becomes a lot smoother.
To install, head back to your wazuh-n8n-lab-setup directory. You’ll see a prepackaged installation script already in there. Run it with:
sudo ./install-postman.sh
Once done you get this confirmation message in your terminal.
You can pin Postman to your dashboard by clicking the icon at the bottom left of your screen. You’d see your postman. Right click and and select pin to dash for easy access when we get into the API work.
Conclusion
And that’s it for Part 1. We’ve got our environment fully stood up, Wazuh is running, the agent is connected, auditd is configured, n8n is ready, and Postman is installed. Everything is in place for what comes next.
In Part 2 wed install Atomic Red Team and begin running attacks with Atomic Red Team and see exactly what Wazuh picks up.
Credit
This lab is based on a Youtube series by Atlantium AI that walks through the full setup visually. If you want to follow along with the video alongside this article you can find the full playlist here: https://youtube.com/playlist?list=PLtyp1BBFawaz946JTxU1MOVZE13d37Yp7
