Enterprise Splunk: SOC Deception & Threat Intelligence Lab

Executive Summary

This project is an end-to-end Enterprise Deception and Security Operations Center (SOC) architecture. Designed to mimic real-world enterprise threat hunting environments, it demonstrates the full lifecycle of adversary tracking: from trapping attackers in an isolated honeypot and logging their keystrokes, to automatically extracting malware payloads and enriching the data with real-time Threat Intelligence.

For Recruiters & Engineering Leaders: This repository serves as a comprehensive demonstration of skills across Cybersecurity Engineering (Deception Technology, network isolation), Data Analytics (Splunk SIEM, SPL, Universal Forwarders), and Security Automation / SOAR (Python scripting, VirusTotal API integration, automated Threat Intel lookups).

---

Core Capabilities

• Network Deception: Utilizes custom iptables rules to create a silent "trapdoor", seamlessly forwarding malicious Port 22 traffic into an isolated environment without the attacker's knowledge.
• High-Interaction Honeypot: Deploys the Cowrie honeypot to simulate a fully interactive Linux filesystem. It captures brute-force credentials, logs live attacker keystrokes, and quarantines dropped malware payloads.
• Centralized SIEM Logging: A Splunk Universal Forwarder is configured to securely ship complex, unstructured JSON logs from the Ubuntu VM directly to a centralized Splunk Enterprise instance.
• Real-Time SOC Dashboard: Advanced Splunk Processing Language (SPL) queries power a visually stunning, executive-level dashboard showing attack timelines, trap effectiveness, and top brute-forced credentials.
• Threat Intelligence Automation: A custom Python script automates the extraction of malware hashes (SHA-256) and queries the VirusTotal API to generate a Threat Intelligence CSV feed.
• Automated Enrichment: The Threat Intel feed is integrated back into Splunk as a Lookup Table, automatically flagging incoming attacks with "Critical" threat labels based on antivirus engine detection rates.

---

System Architecture

graph TD
    A[Attacker / Kali Linux] -->|Port Scans, SSH Brute Force| B(Ubuntu VM Firewall / iptables)
    
    subgraph Deception & Logging Layer
        B -->|Redirects to Port 2222| C[Cowrie Honeypot]
        C -->|Logs Activity & Keystrokes| D[(cowrie.json)]
        D -->|Reads Logs| E[Splunk Universal Forwarder]
    end
    
    subgraph Threat Intelligence Layer
        C -->|Captures Malware Hash| H[vt_enrichment.py]
        H -->|API Request| I{VirusTotal API}
        I -->|Returns Intel| J[(threat_intel_feed.csv)]
    end
    
    E -->|Port 9997| F[Splunk Enterprise SIEM]
    J -.->|Splunk Lookup Table| F
    F -->|Displays Analytics| G[SOC Analyst Dashboard]

Loading

---

Executive Dashboard

The Splunk dashboard actively monitoring live attacks, brute-force credentials, and malware drops.

---

Deployment & Usage Guide

1. Honeypot & Network Deception (Ubuntu Server)

To isolate the environment and deploy the Cowrie honeypot, the system requires specific user permissions and iptables routing:

# 1. Prepare the Ubuntu environment and install dependencies
sudo bash phase1/setup_ubuntu.sh

# 2. Deploy the iptables trapdoor to route Port 22 -> Port 2222
sudo bash phase1/setup_iptables.sh

2. Splunk Universal Forwarder Configuration

The forwarder must be configured to monitor the honeypot's dynamic JSON logs and ship them to the SIEM:

# Add the Cowrie log file to the Splunk Forwarder monitor list
sudo /opt/splunkforwarder/bin/splunk add monitor /home/cowrie/cowrie/var/log/cowrie/cowrie.json -index cowrie -sourcetype cowrie_json

# Restart the forwarder to begin shipping logs
sudo /opt/splunkforwarder/bin/splunk restart

3. Automated Threat Intelligence (Phase 3)

The Python automation script securely queries the VirusTotal API to enrich the captured malware hashes.

cd phase3

# Set the VirusTotal API Key in the environment to keep the codebase secure
export VT_API_KEY="your_api_key_here"

# Run the enrichment script to generate the Threat Intel Feed
python3 vt_enrichment.py

(The generated threat_intel_feed.csv is then uploaded to Splunk as a Lookup Table to automatically flag malicious hashes in the dashboard).

---

Architected and Developed by Seetharam Damarla ❤️