Cybersecurity · beginner
AI-Powered SOC Analyst Agent Home Lab
A beginner-friendly home lab that pairs Kali + Ubuntu VMs with an AI penetration-testing agent — your first hands-on security project that produces real artifacts.
Project overview
Demonstrates practical skills in modern cybersecurity — virtualization, AI augmentation, and cloud-native security concepts — and signals a proactive approach to learning the technologies that modern SOC teams are actually adopting.
Real-world use case
A small or mid-sized business uses an automated SOC agent to monitor their network for suspicious activity, triage alerts, and initiate automated responses without hiring a 24/7 analyst team.
Tools and technologies
- VirtualBox
- Kali Linux
- Ubuntu
- Python
- Open-source AI tools
Skills you can demonstrate
Virtualization, Linux Command Line, AI-Augmented SecOps
Build roadmap
- Install VirtualBox + base VMs
Install VirtualBox on your laptop. Spin up one Ubuntu Server VM (the "victim") and one Kali Linux VM (the "analyst"). - Network the lab safely
Put both VMs on a host-only network so traffic stays isolated. Verify they can ping each other but cannot reach the internet. - Install the AI agent toolkit
On the Kali box, set up Python 3, scikit-learn, and the open-source AI pen-test agent of your choice. Get an OpenAI or Anthropic API key for the natural-language layer. - Generate sample malicious traffic
From Kali, run a basic nmap scan + a Hydra brute-force against the Ubuntu VM. Capture the traffic with tcpdump or Wireshark. - Train the classifier
Use the AI prompt below to build a basic scikit-learn classifier. Feed it your captured traffic + labeled malicious vs benign samples. - Document and demo
Write up the lab as a README with diagrams, attack screenshots, and the classifier output. Record a short demo of the agent flagging an attack live.
Ways to extend the project
Add a small NLP layer that summarizes raw security alerts into plain-English incident reports a non-technical manager can read.
How to showcase your work
- GitHub: Detailed README with VM setup steps, the AI agent code, sample logs, and a demo video of an alert being triaged.
- LinkedIn: Screenshots of the agent classifying simulated attacks, with a 60-second walkthrough video.
- Resume: Focus on "Virtualization", "Linux command line", and "AI-augmented threat detection".