# Security Onion Lab

> Network threat detection with automated Discord alerting

URL: https://www.matthewswong.com/id/projects/security-onion-lab/

A production-grade network security monitoring lab built on a cloud server using Security Onion. The project simulates real-world attacks — HTTP floods, SSH brute-force, DoS — and demonstrates end-to-end threat detection, log analysis, and automated alerting via Discord webhooks.

## How it works

- Provisioned a cloud server and deployed Security Onion via Docker
- Configured Zeek, Suricata, and Elasticsearch for traffic analysis
- Simulated attacks: HTTP load tests, SSH brute force, DoS scenarios
- Analyzed generated alerts and correlated log patterns
- Built automated log parsing and Discord webhook alerting
- Documented attack signatures and detection accuracy

## Features

- Security Onion SIEM deployment
- Multi-vector attack simulation
- Real-time log analysis with Suricata/Zeek
- Automated Discord webhook alerting

## Impact

Demonstrated a full threat detection lifecycle from attack simulation to automated alerting — a practical showcase of SOC-level monitoring skills on a self-provisioned cloud environment.

- Category: DevOps
- Stack: Security Onion, Docker, Linux, Suricata, Zeek, Discord Webhooks

---

- HTML version: https://www.matthewswong.com/id/projects/security-onion-lab/
- English: https://www.matthewswong.com/en/projects/security-onion-lab/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json