Splunk SIEM Home Lab Report

In this project, I designed and implemented a small SIEM Home Lab using Splunk Enterprise and two Windows virtual machines.

The objective of this lab was to simulate log collection, centralized monitoring, and basic SOC dashboard visualization using Splunk.

Environment Setup

The lab environment consisted of:

• One main machine running Splunk Enterprise Server

• Two Windows virtual machines

• Splunk Universal Forwarder installed on both virtual machines

Universal Forwarder Configuration

The first step was installing Splunk Universal Forwarder on both Windows virtual machines.

During the installation process, I configured:

• The IP address of the main Splunk server

• The receiving port (9997)

This allowed both machines to forward logs directly to the Splunk server

Splunk Server Configuration

On the Splunk server, I configured log receiving by navigating to:

Settings → Forwarding and Receiving → Configure Receiving

Then I enabled port:

9997

to allow incoming logs from the Universal Forwarders.

Forwarder Configuration

Additional configurations were applied on the Splunk Universal Forwarders to enable Windows Event Log collection, including:

• Security logs

• System logs

• Application logs

After restarting the forwarders, both virtual machines successfully started sending logs to the Splunk server.

Log Collection Verification

To verify successful communication between the machines and the server, I performed several Splunk queries.

First, I searched for logs related to one of the machines named:

honeybot

The query successfully returned events, confirming that the virtual machines were forwarding logs correctly.

I also executed queries to:

• Count total events

• Count hosts sending logs

The first two hosts shown in the results represented the two Windows virtual machines. Additional hosts appeared because I imported an external cybersecurity log dataset into one of the machines for testing and analysis purposes.

SOC Monitoring Dashboard

After successful log collection, I designed a dashboard named:

SOC Monitoring Dashboard

The dashboard included several monitoring panels:

• Total Events

• Logs by Host

• Logs by Sourcetype

• Honeybot Timeline

• Failed Login Attempts

• Windows Security Events

• Top Targeted Ports

These panels provided centralized visibility into collected events and simulated basic SOC monitoring operations.

Conclusion

This project demonstrated how Splunk can be used to build a functional SIEM Home Lab environment capable of:

• Centralized log collection

• Windows event monitoring

• Log forwarding using Universal Forwarders

• Dashboard visualization and monitoring

The lab successfully simulated a basic SOC environment and provided hands-on experience with Splunk SIEM deployment and monitoring workflows.