Case 01 · Security operations
A home SOC that catches, blocks and cleans up threats
My own small security operations center, running 24/7 on Oracle Cloud ($0) and reachable only through my private Tailscale network. It watches my PC, decides what is malicious and responds on its own, like a lightweight McAfee that I built, tested and can explain line by line.
~4 sto quarantine a bad file
~6 sto block a malicious IP
17,000+known-bad IPs tracked daily
300+alerts triaged, 0 attacks
0ports open to the internet
Problem
Security teams want proof that you can run a SIEM, not just name one. I wanted a real system I could attack safely, watch and tune, the way a SOC analyst does every day.
What it does
- Locks away bad files in about 4 seconds, and can restore them (YARA rules + VirusTotal's 66 antivirus engines)
- Blocks bad IPs in Windows Firewall in about 6 seconds, using threat-intel feeds refreshed every morning
- Warns about ransomware: ransom notes, encrypted files, sudden bursts of file changes
- Runs a full scan every week and shows Windows pop-ups when it acts
- Doubles as my personal VPN: one tap on my phone sends all traffic through the server, encrypted with WireGuard (Tailscale exit node)
Result
- Every detection is mapped to MITRE ATT&CK and proven by a safe test script
- Triaged 300+ alerts on day one: no attacks, and 223 false alarms cut with narrow tuning rules
- Replaced the vendor's default admin and API passwords, then confirmed the old ones were rejected
- Pen-tested it myself: a full 65,535-port scan finds nothing open to the internet; fixed every finding (SSH locked to Tailscale, containers blocked from the cloud metadata service, secrets root-only)
$ make-test-file.ps1
Created downloads\homelab-yara-test.txt
# about 4 seconds later
homelab-av: QUARANTINED reason="YARA: HomeLab_Test_Marker"
Alert (level 12): malicious file quarantined T1204.002
$ restore-quarantine.ps1 -Id 076eebb52a50
Restored downloads\homelab-yara-test.txt