Deploy a real SIEM on AWS with one command. Talk to it in plain English. Run simulated attacks and investigate them with an AI senior analyst walking you through every step. Never touched Terraform, Wazuh, MCP servers, or AI tooling before? That's the point.
You type what you want to know. Mateo translates it into the right query, hits the SIEM through MCP, brings back the data, and tells you what's interesting — while showing his work so you can verify every step yourself. This is what SOC work looks like when AI is genuinely useful.
authentication_success + authentication_failed on agent dev-server-01, last 60 min.
backup over 4 min from 198.51.100.42 — not in CloudVault's known IP allowlist.
backup at 14:32:11 right after the failures. Brute-force pattern.
sudo escalation, then chmod +x on a script in /tmp/.
dev-server-01, sweeping 198.51.100.42 across all three agents...
You're not running tutorials. You're running an investigation — Dana (the CISO) needs evidence the breach is actually contained, SOC 2 collection starts in weeks, and Mateo is the senior analyst Dana brought in to help you get there.
Every prompt translates to real Wazuh queries. Every result is real data from the lab infrastructure you deployed. Every claim Mateo makes, you can verify by clicking into the Wazuh dashboard yourself.
That's the point. The lab is built so the tools teach you while you use them. You're not expected to bring expertise — you're expected to bring two hours and curiosity. Mateo handles the rest.
terraform apply by hand unless you want to.terraform destroy nukes everything when you're done. We set up budget alerts in the prerequisites.By Phase 6 you've stood up a SIEM, hunted for backdoors, written a custom detection rule, and produced the SOC 2 evidence package the CISO actually needs.
dev-server-01 matching the IR report's pattern classes. Investigate the chain manually. Confirm SIEM coverage before you start hunting.wazuh-logtest. Deploy, trigger, verify. Take an automatic active response.terraform destroy with verification.Lab runs on a single t3.large manager + three t3.micro agents. Always terraform destroy when you're done. Budget alert at $10 covers a forgotten weekend.
Full prerequisites checklist is in the README — AWS account + CLI configured, Terraform ≥ 1.5, an EC2 key pair, Claude Code CLI.
# 1. Clone the repo git clone https://github.com/joshbotz/wazuh-ai-soc-lab.git cd wazuh-ai-soc-lab # 2. Configure (your IP + your EC2 key name) cp terraform/terraform.tfvars.example terraform/terraform.tfvars $EDITOR terraform/terraform.tfvars # 3. Deploy. One command. ~20 min, mostly hands-off. ./scripts/bootstrap.sh # 4. Launch Claude Code in the lab directory claude # 5. Tell Mateo you're starting > Start the lab
Mateo takes it from there. While Terraform applies and Wazuh boots, Mateo briefs you on the case, walks the architecture, and gets you ready. No dead time.
Josh Botz — cloud security + AI agent security practitioner. Background in FedRAMP / ConMon, Fortune 500 + IC work.
I built this lab because I wanted to know what AI actually changes about a SOC investigation when you wire it into the tools you'd really use. Not a demo, not a sandbox — a real SIEM, real Terraform, real costs, real alerts. The Mateo persona was the answer to "what would it feel like to have a senior SOC analyst at your shoulder while you work?"
Turns out the answer is: it's a really different way of working, and it's accessible to anyone who's willing to spend two hours and run a script. That's why this lab exists.
If you run it and it lands for you — or it doesn't — I'd genuinely like to hear about it. Connect on LinkedIn.
One command. About a coffee in AWS spend. Two hours of your time. Mateo handles the rest.