I Completed 100 Cybersecurity Labs. Why Build a SOC Homelab Too?

Lessons learned building a SOC homelab with Splunk, Active Directory, Sysmon, and pfSense

Over the last year and a half, I have focused heavily on preparing for a career in cybersecurity. During that time, I completed around 100 cybersecurity labs covering topics ranging from reconnaissance and enumeration to lateral movement, detection engineering, and incident response.

I built strong foundations in networking and security theory, earned several practical certifications, and spent countless hours working through realistic attack scenarios. I even created a small Splunk environment while preparing for the SPLK-1001 certification to deepen my understanding of SIEM fundamentals.

For a long time, I questioned whether building a SOC homelab was really necessary.

My reasoning was simple:

If I had already solved dozens of realistic cybersecurity scenarios online, involving real-world attacks, real-world logs, and real-world investigation techniques, what additional value could a homelab possibly provide?

After finally building one, I discovered the answer:

A lot.

And often in areas I never expected.

Online Labs Teach Security. Homelabs Teach Everything Around Security.

Platforms such as TryHackMe, Hack The Box, Blue Team Labs Online, and practical certifications provide excellent environments to develop cybersecurity skills.

However, they are preconfigured environments.

A SOC homelab is different.

Instead of being given a functioning environment and a challenge to solve, you become responsible for designing, building, securing, troubleshooting, documenting, and maintaining the entire infrastructure yourself.

In a real organization, security analysts do not operate in isolation. They work within an ecosystem composed of networks, servers, operating systems, logging infrastructure, Active Directory, firewalls, DNS, and countless interconnected services.

Building a homelab exposes you to all of these components.

The Skills I Developed While Building My SOC Homelab

Before starting the project, I expected to learn a bit more about Splunk.

What actually happened was that I ended up strengthening skills across multiple technical domains.

Virtualization

The first step involved designing and deploying the virtual environment itself.

This required decisions regarding:

Resource allocation
Virtual networking
Network segmentation
VM lifecycle management
Storage planning

These are concepts that security professionals encounter regularly but are often abstract when learned solely through courses.

All four virtual machines running

Networking

Networking quickly became one of the most valuable learning areas.

My lab included:

pfSense firewall
Windows hosts
Active Directory
DNS services
Splunk server
Sysmon log forwarding

Building connectivity between these systems forced me to understand networking at a deeper level.

I spent significant time working with:

IP addressing
DNS configuration
DHCP configuration
Firewall rules
Network troubleshooting
Internal routing

Many concepts that had previously existed only as theory suddenly became practical exercises with specific problems to solve.

pfSense boot screen

System Administration

A homelab naturally pushes you into system administration.

I found myself configuring:

Windows Server
Active Directory
DNS
Group Policy
Local security settings
Service accounts
Linux servers

This experience significantly improved my understanding of how enterprise environments operate.

Windows Server Group Policy overview after BadBlood script

Linux Administration

Deploying Splunk on a Debian virtual machine became an unexpected learning opportunity.

Working with a minimal installation forced me to become more comfortable with Linux administration tasks.

For example, I discovered that minimal installations do not even include sudo by default and require additional configuration.

Throughout the deployment process, I became increasingly comfortable with:

Package management
User permissions
Service management
File permissions
Configuration files
Hash verification
Network diagnostics

As a result, I was able to practice and freshen up my Linux command-line fluency.

Splunk running on headless Debian 12

Troubleshooting

This was arguably the most valuable skill developed during the entire project.

Things rarely work perfectly the first time.

And that’s exactly where the learning happens.

Throughout the build process, I encountered issues involving:

DNS resolution
Time synchronization
Service configuration
Log forwarding
Connectivity problems
Authentication issues

Troubleshooting forced me to adopt a systematic approach. I learned to validate assumptions and isolate variables using tools such as:

ping
nslookup
Test-NetConnection
Event Viewer
Services console
Splunk search queries
Firewall logs

One example involved investigating why Sysmon logs were not reaching Splunk from a particular workstation while other Windows logs were being ingested successfully. Tracing the issue required examining configurations, services, permissions, and forwarding settings before ultimately identifying the root cause.

These experiences closely resemble the type of investigative thinking required in a SOC environment.

SOC homelab architecture overview

Understanding How Everything Fits Together

One of the biggest benefits of building a homelab is developing systems-level thinking.

In many training environments, technologies are learned independently: Active Directory, Splunk, Windows, Linux, Firewalls, Networking…

A homelab forces you to connect them.

You begin to understand questions such as:

How does Active Directory rely on DNS?
How do endpoints generate telemetry?
How does Sysmon data reach Splunk?
How do firewall rules affect visibility?
How does network architecture impact detection?

This broader perspective is incredibly valuable because security analysts rarely investigate isolated systems. They investigate environments.

Understanding how the pieces interact provides context that significantly improves analytical capability.

Documentation Is a Skill Too

One lesson I did not expect to learn was the importance of documentation.

Throughout the project, I documented:

Architecture decisions
Configuration steps
Troubleshooting procedures
Lessons learned
Validation testing

This not only improved reproducibility but also strengthened my understanding of the environment itself.

Writing down what I was doing forced me to think critically about why I was doing it.

The process transformed a technical exercise into a structured learning experience.

Final Thoughts

Completing cybersecurity labs remains one of the best ways to learn security concepts and develop technical skills.

However, building a SOC homelab provides something different.

It transforms you from a participant operating inside an environment into the person responsible for creating and maintaining that environment.

For me, the project felt like a practical capstone to everything I had learned over the previous year and a half.

It allowed me to apply networking, system administration, Active Directory, Linux, Windows, Splunk, troubleshooting, and documentation skills within a single project while continuing to learn new things every day.

If you are pursuing a career in cybersecurity and have already completed online labs, certifications, and training platforms, I highly recommend building a SOC homelab.

You may start the project intending to learn more about security.

You will likely finish it having learned much more than that.

This is the first article in my SOC homelab series. Stay tuned for upcoming posts, where I’ll share deeper technical insights and real-world SOC practices. If you found this post helpful, feel free to clap, share, or leave a comment. I’d love to hear your thoughts!