Running a Personal SOC: Bringing Production Security Practices Home

Short summary

The author built a personal SOC for their homelab: a daily audit script checking Docker posture, systemd drift, and network activity, combined with a correlation agent that surfaced security findings as searchable Obsidian notes. The key design principle: detection stays deterministic and testable, while the LLM acts only as a downstream narrator, never the source of truth. This catches drift early and mirrors production practices without the overhead.

• •Daily audit collects Docker posture, systemd service drift, network signals, and secrets hygiene scan; writes JSON reports with no remediation
• •SOC agent correlates SSH logs, network alarms, and audit findings into searchable incident timeline with severity levels
• •LLM only summarizes findings; detection logic stays deterministic, testable, and replayable offline

Generated with AI, which can make mistakes.