A virtualized security lab that simulates cloud infrastructure end-to-end: generate traffic and attacks, ship logs with Filebeat, index them in Elasticsearch, and detect threats in Kibana with Suricata IDS.
▸Designed and deployed a virtualized security lab using Ubuntu Server and Kali Linux in VMware Fusion to simulate real-world cloud infrastructure.
▸Configured bridged and NAT networking to model internal and external environments for traffic flow and attack simulation.
▸Implemented the Elastic Stack for log aggregation and built custom Kibana dashboards to monitor failed SSH logins and system events.
▸Deployed Suricata as an intrusion detection system (IDS) for real-time network traffic analysis, forwarding alerts through Filebeat into Elasticsearch for visualization.
Architecture
Ubuntu Server VM
Target host + auth logs
→
Suricata IDS
Network traffic → eve.json
→
Filebeat
Log shipper
→
Elasticsearch
Index & store
→
Kibana
Dashboards & alerts
A Kali Linux VM generates malicious traffic and SSH brute-force attempts against the Ubuntu host. Suricata inspects the traffic, Filebeat forwards both IDS alerts and system logs into Elasticsearch, and Kibana visualizes detections in real time.
In Action
ELK real-time monitoring — Suricata IDS alerts
Suricata eve.json alerts shipped by Filebeat into Elasticsearch and explored in Kibana Discover (event_type:"alert") — each event classified by signature, severity, and category in real time.
SSH login attempts dashboard
Custom Kibana dashboard tracking SSH login attempts over time, brute-force attempts by host, the most-targeted usernames, and the geographic source of failed logins.
