{"id":235,"date":"2026-08-14T09:02:39","date_gmt":"2026-08-14T13:02:39","guid":{"rendered":"https:\/\/securebydefault.io\/blog\/?p=235"},"modified":"2026-08-14T09:02:40","modified_gmt":"2026-08-14T13:02:40","slug":"home-soc-splunk-server-attackers","status":"publish","type":"post","link":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/","title":{"rendered":"I Built a Home SOC on My Own Server."},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"536\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured-1024x536.png\" alt=\"\" class=\"wp-image-236\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured-1024x536.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured-300x157.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured-768x402.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">I have been wanting real security operations experience for a while now, not the kind you get from a course that hands you clean, pre-staged logs, but the kind where you are staring at your own infrastructure and something actually happens while you are watching. So I decided to stop simulating it and just build it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The plan was simple enough on paper. Install Splunk Enterprise on my own production Linux server, the same Ubuntu box on Linode (now part of Akamai Cloud, where I used to work and still have a soft spot for) that hosts SecureByDefault, point it at a few real log sources, and build detections the way an enterprise SOC analyst would. Learn by doing, on infrastructure that actually matters to me, instead of a lab environment where the worst case is a snapshot rollback.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What I did not expect was how fast the &#8220;live fire&#8221; part of that plan would kick in. I was still wiring up log sources when I found out my server had already been getting probed for web shells. And a few days later, my own detection stack turned around and locked me out of my own server. Both of those turned out to be the most useful parts of the whole project.<br><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-bc640b3e7f6d5dd049e71598c04c9521 wp-block-paragraph\"><strong>What I Built<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator alignwide has-text-color has-ast-global-color-8-color has-alpha-channel-opacity has-ast-global-color-8-background-color has-background is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">I installed Splunk Enterprise directly on the server rather than standing up a separate log collector, mostly because I wanted to keep the lab close to how a small business or solo engineer would actually run this: one box, doing double duty, no dedicated SIEM budget.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From there I wired up three log sources that actually matter for a small internet-facing server:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\/var\/log\/auth.log, which captures every SSH authentication attempt, successful or not<\/li>\n\n\n\n<li>\/var\/log\/nginx\/access.log, which captures every HTTP request hitting the web server<\/li>\n\n\n\n<li>\/var\/log\/fail2ban.log, which captures every automated ban Fail2Ban issues<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">On top of those three sources, I built three detection searches and pulled them together into a single dashboard I named &#8220;SecureByDefault Server SOC.&#8221; Nothing fancy. Three panels, three questions answered: is someone probing my web server, is someone hammering SSH, and is my automated defense actually doing anything about it.<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"386\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SecureByDefault-SOC-1024x386.png\" alt=\"\" class=\"wp-image-238\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SecureByDefault-SOC-1024x386.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SecureByDefault-SOC-300x113.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SecureByDefault-SOC-768x290.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SecureByDefault-SOC-1536x580.png 1536w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SecureByDefault-SOC.png 1630w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-e8dfa5d56cdd31172b7d5450783eaed6 wp-block-paragraph\"><strong>What I Found While I Was Still Setting It Up<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator alignwide has-text-color has-ast-global-color-8-color has-alpha-channel-opacity has-ast-global-color-8-background-color has-background is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the part that got my attention. I had not even finished configuring the dashboard when I ran a search across the Nginx logs just to sanity check that data was flowing correctly. It was flowing correctly. It was also showing me that a single IP address, 4.223.96.99, had already sent 580 HTTP GET requests to my server, all of it probing for PHP web shells.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The paths were not random guesses. A lot of them were randomized filenames, the kind of thing you would expect a previously compromised server to have sitting in a web root somewhere: \/\/ovarobsxs.php, \/\/xs5x46mb.php, \/\/yaztn.php. Others were clearly aimed at WordPress installs specifically, things like \/\/wp-admin\/js\/index.php and \/\/wp-content\/cong.php, even though this server has never run WordPress.<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1005\" height=\"579\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/580-Events.png\" alt=\"\" class=\"wp-image-241\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/580-Events.png 1005w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/580-Events-300x173.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/580-Events-768x442.png 768w\" sizes=\"auto, (max-width: 1005px) 100vw, 1005px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Every single one of those 580 requests came back with a 404 or a 301. The attacker found nothing, because there was nothing to find. But watching it happen in real time, request after request, filename after filename, made something click that no article about &#8220;attackers scan constantly&#8221; ever really landed for me before. This was not a hypothetical. This was one automated tool, methodically working through a list of paths, against a server that had barely been online.<br><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"483\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/web-shell-1024x483.png\" alt=\"\" class=\"wp-image-242\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/web-shell-1024x483.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/web-shell-300x141.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/web-shell-768x362.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/web-shell.png 1182w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<div style=\"border-left: 4px solid #00D4FF; background-color: #EAF8FF; padding: 14px 18px; margin: 20px 0; border-radius: 0 4px 4px 0;\">\n\n<em style=\"color: #1A2B3C; font-size: 15px; line-height: 1.6;\">Here is the part worth sitting with: those randomized filenames are not made up. They almost certainly come from a list of paths seen on other servers that were actually compromised at some point. The scanner is not guessing. It is checking whether your server has the same leftover backdoor as someone else&#8217;s<\/em>\n<\/div>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-921650264284f28fbe52712d9086ac9a wp-block-paragraph\"><strong>The Part Where I Locked Myself Out<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator alignwide has-text-color has-ast-global-color-8-color has-alpha-channel-opacity has-ast-global-color-8-background-color has-background is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">A few days later I moved on to testing the SSH detection side of things. The plan was straightforward: generate some failed login attempts using a fake username from my local machine, confirm they showed up in Splunk, and call that detection validated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It validated a little harder than I intended.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2Ban caught the pattern of failed logins exactly the way it is supposed to, decided the source IP looked like an attacker, and banned it. The problem was that the source IP was me. I was locked out of my own server, from my own home connection, by my own security tooling, doing exactly what I had configured it to do.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"306\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/ssh-invalid-1024x306.png\" alt=\"\" class=\"wp-image-245\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/ssh-invalid-1024x306.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/ssh-invalid-300x90.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/ssh-invalid-768x230.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/ssh-invalid.png 1181w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">There is a specific kind of humbling that happens when you get outsmarted by a tool you configured yourself an hour earlier. I sat there for a second, laughed, and then went and pulled up Linode&#8217;s out-of-band Lish console, which gives you a direct terminal session into the server even when normal network access is blocked. From there I unbanned my own IP, and then did the thing I should have done before running the test in the first place: added my home IP to the Fail2Ban ignoreip whitelist so this would not happen again.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"271\" src=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/fail2ban-1024x271.png\" alt=\"\" class=\"wp-image-246\" srcset=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/fail2ban-1024x271.png 1024w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/fail2ban-300x79.png 300w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/fail2ban-768x203.png 768w, https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/fail2ban.png 1182w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Nothing broke. Nothing was actually wrong. The system worked exactly as designed, and the only casualty was about ten minutes of my afternoon and a little bit of my ego. But it taught me something that no amount of reading about Fail2Ban ever would have: these tools are not abstract concepts on a slide, they have real, immediate consequences for real access, including your own.<\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-19cf1fd13bff86f0d6610cc597a418d4 wp-block-paragraph\"><strong>What the Dashboard Actually Shows<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator alignwide has-text-color has-ast-global-color-8-color has-alpha-channel-opacity has-ast-global-color-8-background-color has-background is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">The finished dashboard is deliberately simple. Three panels, each answering one question.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Web Shell Scanner Detection<\/strong> pulls raw Nginx log entries for requests matching known web shell probe patterns, the randomized PHP filenames and WordPress-style paths from earlier. This is the panel that would have told me about the 580 requests immediately if it had existed a day sooner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SSH Invalid User Detection<\/strong> shows connection attempts that get rejected at the preauth stage, meaning the attacker never even gets far enough to try a password. It is a good early signal of automated SSH scanning before it becomes a real brute-force attempt.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fail2Ban Ban Events<\/strong> shows the automated ban actions themselves, timestamped, so I can correlate a spike in failed logins with the moment Fail2Ban actually stepped in and did something about it. Including, apparently, the moment it stepped in and did something about me.<\/p>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-ec88ca68f3127bba852a7bbbf5de821d wp-block-paragraph\"><strong>Key Takeaways<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator alignwide has-text-color has-ast-global-color-8-color has-alpha-channel-opacity has-ast-global-color-8-background-color has-background is-style-wide\"\/>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>You do not need enterprise infrastructure to build real SOC skills.<\/strong> One small server and a free tier of Splunk gets you closer to real detection engineering than most courses will.<\/li>\n\n\n\n<li><strong>Automated scanners will find your server within hours of it going live.<\/strong> Not weeks. Not days. Hours. Assume you are being scanned from the moment your IP is reachable.<\/li>\n\n\n\n<li><strong>Web shell scanners are not just checking for famous backdoor names.<\/strong> They are working through randomized filenames pulled from other compromised servers, which means the scan is broader and more methodical than most people assume.<\/li>\n\n\n\n<li><strong>A properly hardened server deflects the vast majority of this silently.<\/strong> SSH key-only authentication, UFW, and Fail2Ban turned 580 probe attempts into 580 nothing-burgers. That is the whole point of hardening: not that attacks stop happening, but that they stop mattering.<\/li>\n\n\n\n<li><strong>Getting locked out by your own detection system is one of the best learning experiences in security operations.<\/strong> It is annoying in the moment. It is also the fastest way to actually understand how these tools behave under real conditions instead of theoretical ones.<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-2-color has-text-color has-link-color has-medium-font-size wp-elements-9a19bc35d5aec943389a10f79273bf6b wp-block-paragraph\"><strong>Where This Goes Next<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator alignwide has-text-color has-ast-global-color-8-color has-alpha-channel-opacity has-ast-global-color-8-background-color has-background is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">This is going to be an ongoing series rather than a one-off project. I am planning to add more detections, more log sources, and eventually walk through a couple of the more interesting patterns showing up in the data in their own dedicated posts. If you are trying to break into SOC work or just want to see what a small, real, internet-facing server actually looks like under constant automated probing, this is going to be a useful thing to follow.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to build something similar yourself, you genuinely do not need much. A small VPS, the free tier of Splunk, and the willingness to occasionally lock yourself out of your own server in the name of learning.<\/p>\n\n\n\n<div style=\"margin:48px 0 20px;padding:36px 32px;background:#050C18;border:1px solid #1A3A5C;border-top:3px solid #00D4FF;border-radius:8px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;text-align:center;\">\n\n  <div style=\"font-family:'Courier New',monospace;font-size:11px;letter-spacing:0.18em;text-transform:uppercase;color:#00D4FF;margin-bottom:14px;\">\n    \/\/ Before you go\n  <\/div>\n\n  <h3 style=\"margin:0 0 14px;font-size:24px;font-weight:800;color:#EEF5FF;line-height:1.25;\">\n    Get the security checklist most<br>businesses skip.\n  <\/h3>\n\n  <p style=\"margin:0 auto 24px;max-width:440px;font-size:15px;line-height:1.65;color:#8BB8D8;\">\n    A free 25-point audit covering the exact gaps attackers hit first, written by an engineer in plain language. Plus one practical security breakdown every Tuesday.\n  <\/p>\n\n  <a href=\"https:\/\/newsletter.securebydefault.io\" target=\"_blank\" rel=\"noopener\"\n     style=\"display:inline-block;background:#00D4FF;color:#050C18;text-decoration:none;\n     font-weight:700;font-size:15px;padding:15px 36px;border-radius:4px;letter-spacing:0.02em;\">\n    Get the Free Checklist &rarr;\n  <\/a>\n\n  <p style=\"margin:18px 0 0;font-family:'Courier New',monospace;font-size:11px;color:#4A7A9B;letter-spacing:0.04em;\">\n    Free on signup &nbsp;\u00b7&nbsp; Unsubscribe anytime &nbsp;\u00b7&nbsp; ~1 email per week\n  <\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>I installed Splunk on my own production server to build real SOC skills. Here&#8217;s what I found already probing my server, and how I locked myself out with my own detection stack.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[38,104,105],"tags":[48,112,13,107,79,113,73,9,108,106,109,111,110],"class_list":["post-235","post","type-post","status-publish","format-standard","hentry","category-blue-team","category-home-lab","category-soc","tag-blue-team","tag-detection-engineering","tag-fail2ban","tag-home-lab","tag-linode","tag-security-operations","tag-server-hardening","tag-server-security","tag-soc","tag-splunk","tag-ssh-security","tag-ubuntu","tag-web-shell"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>I Built a Home SOC on My Own Server. - SecureByDefault<\/title>\n<meta name=\"description\" content=\"I installed Splunk on my own production server to build real SOC skills. Here&#039;s what I found already probing my server, and how I locked myself out with my own detection stack.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"I Built a Home SOC on My Own Server. - SecureByDefault\" \/>\n<meta property=\"og:description\" content=\"I installed Splunk on my own production server to build real SOC skills. Here&#039;s what I found already probing my server, and how I locked myself out with my own detection stack.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/\" \/>\n<meta property=\"og:site_name\" content=\"SecureByDefault\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-14T13:02:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-14T13:02:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ron Mercier\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ron Mercier\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/\"},\"author\":{\"name\":\"Ron Mercier\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"headline\":\"I Built a Home SOC on My Own Server.\",\"datePublished\":\"2026-08-14T13:02:39+00:00\",\"dateModified\":\"2026-08-14T13:02:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/\"},\"wordCount\":1438,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"image\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/SBD_Blog_HomeSOC_Featured-1024x536.png\",\"keywords\":[\"blue team\",\"Detection Engineering\",\"fail2ban\",\"Home Lab\",\"Linode\",\"Security Operations\",\"Server Hardening\",\"server security\",\"SOC\",\"Splunk\",\"SSH Security\",\"Ubuntu\",\"Web Shell\"],\"articleSection\":[\"Blue Team\",\"Home Lab\",\"SOC\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/\",\"name\":\"I Built a Home SOC on My Own Server. - SecureByDefault\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/SBD_Blog_HomeSOC_Featured-1024x536.png\",\"datePublished\":\"2026-08-14T13:02:39+00:00\",\"dateModified\":\"2026-08-14T13:02:40+00:00\",\"description\":\"I installed Splunk on my own production server to build real SOC skills. Here's what I found already probing my server, and how I locked myself out with my own detection stack.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/SBD_Blog_HomeSOC_Featured.png\",\"contentUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/SBD_Blog_HomeSOC_Featured.png\",\"width\":1200,\"height\":628},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/home-soc-splunk-server-attackers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"I Built a Home SOC on My Own Server.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/\",\"name\":\"SecureByDefault\",\"description\":\"Cloud Security &amp; Cybersecurity for IT Professionals\",\"publisher\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/#\\\/schema\\\/person\\\/2ee989263a69e3324bce0cbed28ec0e8\",\"name\":\"Ron Mercier\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"contentUrl\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\",\"width\":512,\"height\":512,\"caption\":\"Ron Mercier\"},\"logo\":{\"@id\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SecureByDefault_Log.png\"},\"sameAs\":[\"https:\\\/\\\/securebydefault.io\\\/blog\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/ron-mercier\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDyWOTMI23S8Y3zwPoX3UkQ\"],\"url\":\"https:\\\/\\\/securebydefault.io\\\/blog\\\/author\\\/sbd_admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"I Built a Home SOC on My Own Server. - SecureByDefault","description":"I installed Splunk on my own production server to build real SOC skills. Here's what I found already probing my server, and how I locked myself out with my own detection stack.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/","og_locale":"en_US","og_type":"article","og_title":"I Built a Home SOC on My Own Server. - SecureByDefault","og_description":"I installed Splunk on my own production server to build real SOC skills. Here's what I found already probing my server, and how I locked myself out with my own detection stack.","og_url":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/","og_site_name":"SecureByDefault","article_published_time":"2026-08-14T13:02:39+00:00","article_modified_time":"2026-08-14T13:02:40+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured.png","type":"image\/png"}],"author":"Ron Mercier","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ron Mercier","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#article","isPartOf":{"@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/"},"author":{"name":"Ron Mercier","@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"headline":"I Built a Home SOC on My Own Server.","datePublished":"2026-08-14T13:02:39+00:00","dateModified":"2026-08-14T13:02:40+00:00","mainEntityOfPage":{"@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/"},"wordCount":1438,"commentCount":0,"publisher":{"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"image":{"@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#primaryimage"},"thumbnailUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured-1024x536.png","keywords":["blue team","Detection Engineering","fail2ban","Home Lab","Linode","Security Operations","Server Hardening","server security","SOC","Splunk","SSH Security","Ubuntu","Web Shell"],"articleSection":["Blue Team","Home Lab","SOC"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/","url":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/","name":"I Built a Home SOC on My Own Server. - SecureByDefault","isPartOf":{"@id":"https:\/\/securebydefault.io\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#primaryimage"},"image":{"@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#primaryimage"},"thumbnailUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured-1024x536.png","datePublished":"2026-08-14T13:02:39+00:00","dateModified":"2026-08-14T13:02:40+00:00","description":"I installed Splunk on my own production server to build real SOC skills. Here's what I found already probing my server, and how I locked myself out with my own detection stack.","breadcrumb":{"@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#primaryimage","url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured.png","contentUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/08\/SBD_Blog_HomeSOC_Featured.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/securebydefault.io\/blog\/home-soc-splunk-server-attackers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/securebydefault.io\/blog\/"},{"@type":"ListItem","position":2,"name":"I Built a Home SOC on My Own Server."}]},{"@type":"WebSite","@id":"https:\/\/securebydefault.io\/blog\/#website","url":"https:\/\/securebydefault.io\/blog\/","name":"SecureByDefault","description":"Cloud Security &amp; Cybersecurity for IT Professionals","publisher":{"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/securebydefault.io\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/securebydefault.io\/blog\/#\/schema\/person\/2ee989263a69e3324bce0cbed28ec0e8","name":"Ron Mercier","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","url":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","contentUrl":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png","width":512,"height":512,"caption":"Ron Mercier"},"logo":{"@id":"https:\/\/securebydefault.io\/blog\/wp-content\/uploads\/2026\/05\/SecureByDefault_Log.png"},"sameAs":["https:\/\/securebydefault.io\/blog","https:\/\/www.linkedin.com\/in\/ron-mercier\/","https:\/\/www.youtube.com\/channel\/UCDyWOTMI23S8Y3zwPoX3UkQ"],"url":"https:\/\/securebydefault.io\/blog\/author\/sbd_admin\/"}]}},"_links":{"self":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/comments?post=235"}],"version-history":[{"count":10,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/235\/revisions"}],"predecessor-version":[{"id":251,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/posts\/235\/revisions\/251"}],"wp:attachment":[{"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/media?parent=235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/categories?post=235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securebydefault.io\/blog\/wp-json\/wp\/v2\/tags?post=235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}