I built a virtual cybersecurity monitoring environment using VMware Workstation, Security Onion 3.0, Kali Linux, Ubuntu, and Windows to simulate and investigate network security threats.
For this project, I conducted an authorized network reconnaissance exercise using Nmap from Kali Linux (192.168.52.130) against a designated test target (192.168.52.1).
Using Security Onion's Hunt interface, I investigated the resulting network activity through Zeek connection logs and Suricata alerts.
Zeek recorded 50 TCP connection events involving multiple destination ports, including 21 (FTP), 22 (SSH), 80 (HTTP), 443 (HTTPS), and 445 (SMB). Several connection records showed the S0 state, indicating connection attempts without observed responses.
I also identified four related Suricata ICMP ping alerts and correlated the evidence using source and destination IP addresses, timestamps, network protocols, and detection records.
I documented the investigation in Security Onion Cases as CASE-001: Network Reconnaissance Investigation – Nmap Port Scan, attached supporting events, recorded the findings, and closed the case as authorized security testing.
The investigation did not establish a successful system compromise.
This project strengthened my practical skills in network traffic analysis, threat detection, security event correlation, incident investigation, and Security Operations Center (SOC) documentation.
If I were to repeat this project, I would spend more time planning the network configuration and documenting each step before starting the investigation.
One challenge was making sure my virtual machines could communicate properly and that Security Onion was capturing the correct network traffic. I learned the importance of verifying IP addresses, network interfaces, and connectivity before running security tests.
I would also establish a baseline of normal network activity before generating simulated attacks. This would help me distinguish legitimate traffic from suspicious behavior more effectively.
Finally, I would improve my investigation workflow by collecting packet captures, correlating Zeek and Suricata events, and documenting my findings as I progress rather than waiting until the end.
These improvements would make future investigations more efficient, organized, and closer to the procedures followed in a real Security Operations Center.
