SIEM Lab - pfSense + Ubuntu + Kali + Splunk + Splunk UF

Short description: A reproducible lab demonstrating ingest, parsing, detection, and dashboards for pfSense firewall logs and Ubuntu host telemetry using Splunk.

Quickstart

• See docs/ for architecture, test plan, and playbooks.
• Example configs are in configs/.
• Dashboards and saved searches are in splunk/.
• Log files, configuration snapshots, and screenshots collected during each test case in evidence/.

Ultimate Goal

Document the architecture for the SIEM lab used to ingest pfSense and Ubuntu (host) telemetry, run Kali simulation vulnerability/pen tests, and evaluate detections in Splunk through visualized and understandable metrics.

License

This project is licensed under the MIT License. See LICENSE.