So, I decided to build a home security operations center (SOC) using Security Onion an open-source platform for intrusion detection, network monitoring, and log management. I repurposed an old HP 110-021 desktop, upgraded the RAM to 16 GB, and set up Ubuntu Server running inside a virtual machine.

To simulate a small attack surface, I forwarded common ports (21, 22, 80, 443) and configured Wireshark to inspect network traffic. At first, I only saw traffic from the host itself until I learned I needed a switch with port mirroring capability. A quick trip to Fry’s Electronics and a $40 TL-SG108E switch later, I was finally seeing full network visibility.

Within hours of going live, the server began receiving thousands of intrusion attempts. Reviewing alerts in Squert, I found that the majority originated from IPs geolocated to China. That experiment taught me two key lessons:

• The internet is far more hostile than it appears from behind a consumer router.

• Even small, experimental systems benefit from layered defenses and segmentation.

Looking back, that early project helped spark my passion for threat detection, a curiosity that still drives my work today.