01 / Segmentation
Separate DMZ, user, server, endpoint, honeypot and monitoring VLANs are proposed to illustrate traffic boundaries and reduce unnecessary access between zones.
Project 001 / Architecture study
PhilSIEM v2: Security Monitoring Architecture
A proposed home-lab design exploring segmented networks, honeypot telemetry, endpoint monitoring and centralised security analysis.
PROPOSED DESIGN · NOT DEPLOYEDProject status: This diagram represents a planned architecture, not an operational deployment. Network addresses, components and workflows shown are design examples. No live security telemetry is presented here.
Design overview
Defence in depth, by design
02 / Detection sources
The design combines Cowrie SSH/Telnet honeypot events, Windows Sysmon endpoint telemetry and mirrored network traffic for complementary visibility.
03 / Analysis
A planned Security Onion monitoring layer incorporates Suricata, Zeek and Elastic tooling, with Kibana as the proposed interface for reviewing security events.
Illustrative scenario
From suspicious activity to investigation
- Observe: An SSH brute-force attempt targets the proposed Cowrie honeypot.
- Collect: Honeypot logs are forwarded to the planned monitoring environment.
- Detect: Rules and event correlation identify behaviour worth investigating.
- Investigate: The analyst reviews available evidence in the proposed Kibana dashboard.
- Document: Findings, confidence levels and next steps are recorded as an investigation note.
This is an illustrative workflow based on the design, not a claim that this specific detection has occurred.
Design rationale
What this project demonstrates
The aim is to practise architectural thinking: where telemetry originates, how monitoring tools receive it, why network separation matters and how a SOC analyst turns alerts into evidence-led decisions.
Future iterations can document individual components as they are installed, tested and validated. Until then, the diagram remains a transparent record of the intended system.