Build a Military-Grade SOC for $0 (Wazuh + Docker + Python)

**STOP paying $5,000/month for enterprise security tools like Splunk or Datadog just to monitor your home lab or small business server.

You can build a Military-Grade Security Operations Center (SOC) entirely for free using Open Source tools.

In this masterclass, I’ll show you how to deploy Wazuh (The Open Source SIEM) using Docker, and then we will write a custom Python Attack Bot to test our defenses in real-time.
**

📺 Watch the Full Masterclass

https://youtu.be/VuLllgyujqs?si=tcHu2FzSqHxvl7EE

---

🛠️ What We Build in This Video:

---

1. The Architecture: Setting up the Wazuh Manager (The Brain) and Agents (The Eyes).
2. Docker Deployment: Getting the stack up in under 3 minutes.
3. The Attack: Writing a Python script (audit_tool.py) to simulate a brute-force attack.
4. The Defense: Configuring a Custom XML Rule to detect the pattern and auto-ban the IP.

---

### 👨‍💻 The Code

Don't want to type everything from the video? Here is the source code for the tools we built.

1. The Python Attack Bot (audit_tool.py)

Use this script to simulate an attack on your own server (Do NOT use this on servers you don't own).

python

import paramiko
import socket
import time

# CHANGE THIS to your local server IP
TARGET_IP = "192.168.1.XX" 
USER = "root"

print(f"[*] Starting Audit Tool targeting {TARGET_IP}...")

while True:
    password = input("Enter Password to Test: ")

    try:
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

        # Attempt Connection
        client.connect(TARGET_IP, username=USER, password=password, timeout=3)
        print("[+] SUCCESS: Password Found!")
        client.close()
        break

    except paramiko.AuthenticationException:
        print("[-] Auth Failed: Wrong Credentials.")
    except socket.error:
        print("[!!!] CONNECTION REFUSED: Server blocked us! (Active Response Worked)")
        break
    except Exception as e:
        print(f"[!] Error: {e}")

<rule id="100003" level="10" frequency="15" timeframe="10">
  <if_matched_sid>60137</if_matched_sid>
  <description>Critical: Massive Logoff Flood Detected (Possible Brute Force)</description>
</rule>