Custody-SOC is a defensive cybersecurity lab that connects centralised detection with alert-driven forensic automation. It was built as one M.Sc. Cybersecurity project serving two courses: System Administration and Security, and Digital Forensics.
The central design rule is simple: every collected forensic artefact must map to a real alert. A Wazuh alert can open a DFIR-IRIS case, collect only alert-referenced evidence, hash it at collection time, enrich observables through Cortex and MISP, and record an auditable timeline.
Project status: the distributed Profile-C lab and its end-to-end scenarios have been validated and documented. The formal independent phase-gate review and team sign-off are still pending; the repository does not claim otherwise.
- Wazuh SIEM installation, hardening, custom MITRE ATT&CK-mapped rules, and verification scripts.
- Linux and Windows endpoint telemetry with Sysmon and file-integrity monitoring.
- Suricata IDS integration.
- DFIR-IRIS, Cortex, and MISP deployment material.
- Alert-to-case orchestration with collection-time SHA-256 hashing and an alert-to-artefact code gate.
- Safe, isolated-lab validation scenarios using dependency-free runners and the EICAR test file—never real malware.
- Evidence, runbooks, two course reports, a unified report, and the joint oral-defense presentation.
Linux / Windows / Suricata
|
v
Wazuh detection core
|
qualifying alert
v
DFIR-IRIS case + orchestration
|
+--> alert-scoped evidence --> SHA-256 manifest
+--> Cortex / MISP enrichment
+--> timestamped audit trail
The realised deployment uses the roadmap's distributed Profile-C model: a Wazuh/Suricata hub on a VPS and local VMware victims plus the SOAR stack, joined through a Tailscale overlay.
- System Administration and Security report
- Digital Forensics report
- Unified project report
- Joint project-defense presentation
Editable Word versions of all reports are available in docs/reports. The presentation includes speaker notes.
| Path | Purpose |
|---|---|
siem/, endpoints/, network/ |
Detection core, endpoint telemetry, and IDS configuration |
soar/ |
DFIR-IRIS, Cortex, MISP, and TheHive reference material |
orchestration/ |
Alert-to-case automation and the alert-to-artefact gate |
forensics/ |
Evidence verification and automation-vs-integrity evaluation |
simulation/ |
Safe, MITRE-mapped lab validation scenarios |
scripts/ |
Phase verification scripts |
docs/evidence/ |
Captured validation evidence and transcripts |
docs/reports/ |
Final reports in PDF and DOCX formats |
docs/presentations/ |
Oral-defense presentation |
Start with the build roadmap, then use the runbook and demo guide.
This repository is for defensive security coursework in an isolated lab. Keep attack simulations inside systems you own or are explicitly authorised to test. Do not commit real credentials, API keys, private keys, or live .env files; use the tracked .env.example templates.
The repository-side checks include:
bash -n scripts/*.sh forensics/verify-evidence.sh
shellcheck scripts/*.sh forensics/verify-evidence.shService-specific validation instructions and acceptance criteria live beside each component and in docs/PROGRESS.md. Real lab validation evidence is labelled separately from repository-only syntax checks.
See CONTRIBUTING.md before proposing changes. No open-source license has been granted yet; public availability does not by itself grant reuse rights.