VM Setup [SOC Automation with AI Implementation]

Project Overview:

Build an automated workflow using n8n. Splunk will ingest logs, create an alert and send it to n8n where ChatGPT can process the alert and output the information on to slack.

Required Files:

VM Environment Software:

• Oracle VirtualBox (https://www.virtualbox.org/)

OS ISOs:

• Kali Linux ISO (https://www.kali.org/get-kali/#kali-virtual-machines)
• Ubuntu Server ISO (https://ubuntu.com/download/server)
• Windows 10 ISO (https://www.microsoft.com/en-us/software-download/windows10)

VM Setup:

Before I can begin automating anything, I must first set up the Virtual Machine environments that will be used to run the n8n Server, the Splunk Server, the Ubuntu Client, and the Windows Client. I generally prefer to allocate enough resources so as to give the VMs more headroom to allow them to deal with more stress.

Windows Client:

For the installation of the Windows Client, I set the Base Memory to 4GB, the core count to 2, and the Disk Size to 50GB. The installation if fairly straight forward and can mostly be left unattended.

Kali Linux:

After downloading the VirtualBox files and extracting the folder, double clicking on the ".vbox" file will automatically import a Kali Linux VM.

After importing the Kali Linux VM, I changed the Base Memory to 4GB and left the rest of the settings the same.

Ubuntu Server (Splunk):

For the Ubuntu based Splunk Server, I set the Base Memory to 8GB, the core count to 2, and the Disk Size to 100GB. There are two screens that will require user input.

The first instance in which any user input is required is the Profile Configuration screen. The second is for SSH Configuration. I want to make sure that we install the OpenSSH server package to allow me to SSH into the VM using SSH on my host machine. After rebooting, the VM should be ready for use.

Ubuntu Server (n8n)

The setup for this server is exactly the same as the one for the Splunk VM, so the same steps may be followed.

Summary and Reflection:

Getting the Virtual Machines set up will give me an easier time installing the different components now that I have laid the groundwork for the rest of the project. Splunk isn't the first SIEM I have experience with so I'm expecting it to go smoother than it did with my first time setting up Wazuh.