chore(deps): bump DavidAnson/markdownlint-cli2-action from 16 to 22

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]

.github/workflows/lint.yml

@@ -4,7 +4,7 @@ jobs:
   markdownlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DavidAnson/markdownlint-cli2-action@v16
+      - uses: actions/checkout@v6
+      - uses: DavidAnson/markdownlint-cli2-action@v22
         with:
           globs: "**/*.md"

.gitignore

@@ -0,0 +1,9 @@
+.DS_Store
+*.swp
+*~
+.idea/
+.vscode/
+__pycache__/
+*.pyc
+.env
+*.log

.markdownlint.json

@@ -0,0 +1,10 @@
+{
+  "MD013": false,
+  "MD022": false,
+  "MD031": false,
+  "MD032": false,
+  "MD033": false,
+  "MD034": false,
+  "MD040": false,
+  "MD041": false
+}

CONTRIBUTING.md

@@ -0,0 +1,22 @@
+# Contributing
+
+Thanks for your interest in contributing!
+
+## Quick Fixes
+
+- Pick one clear thing to fix or improve
+- Keep the change small and focused
+- Open a PR with a clear description
+
+## Bigger Changes
+
+- Open an issue first to discuss the approach
+- Include before/after context in your PR
+- Keep one PR = one logical change
+
+## General
+
+- Write clear commit messages
+- Be kind in discussions
+
+Questions? Open an issue or reach out on [LinkedIn](https://www.linkedin.com/in/stevenjvik/).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Steven J. Vik
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,10 +1,25 @@
 # SJV SOC Lab
 
-I am rebuilding my cybersecurity lab and portfolio from scratch in 2026.
+Cybersecurity lab and portfolio built on a self-hosted Proxmox cluster. Running Wazuh SIEM with monitored endpoints, custom detection rules mapped to MITRE ATT&CK, and incident response playbooks.
 
-This repo will collect:
-- Simple incident response playbooks
-- Small PowerShell and Python tools for log triage
-- Notes from my home lab and learning experiments
+## What's Here
 
-Nothing here is production-ready. It is a playground for me to learn and show progress.
+- **[siem/](siem/)** - Wazuh SIEM deployment, custom rules, agent enrollment, Sigma-to-Wazuh conversion
+- **[playbooks/](playbooks/)** - Incident response playbooks for common scenarios
+- **[detection/](detection/)** - Sigma detection rules and alert logic
+- **[hardening/](hardening/)** - OS and service hardening baselines
+- **[monitoring/](monitoring/)** - Infrastructure monitoring notes
+- **[automation/](automation/)** - Scripts for log triage and response
+- **[plans/](plans/)** - Roadmap for lab expansion
+
+## Lab Stack
+
+| Component | Details |
+|-----------|---------|
+| SIEM | Wazuh 4.9.2 all-in-one (manager + indexer + dashboard) |
+| Endpoints | Debian 12 LXC containers on 3-node Proxmox HA cluster |
+| Detection | Built-in rules + custom rules with MITRE ATT&CK mapping |
+| Alerting | Email via msmtp/Gmail for high-severity events |
+| Monitoring | Grafana + Prometheus (infra), Wazuh (security) |
+
+Everything here comes from running production-grade infrastructure — real configs, real detections, real lessons learned.

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in any SJVIK Labs project, please report it responsibly.
+
+**Email:** stevenjvik.work@gmail.com
+
+Please include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+We will acknowledge receipt within 48 hours and aim to resolve confirmed vulnerabilities promptly.
+
+## Scope
+
+This repository contains security reference materials (playbooks, detection rules, hardening baselines, automation scripts). While the content itself describes security operations, the repository infrastructure (CI, dependencies, build pipeline) is in scope for vulnerability reports.
+
+## Supported Versions
+
+We only support the latest version on the `main` branch.

automation/README.md

@@ -0,0 +1,38 @@
+# Automation
+
+Python and Bash scripts for operational security tasks in the SOC lab.
+
+## Purpose
+
+These scripts automate repetitive SOC and sysadmin workflows: log analysis, backup validation, and IOC triage. They use only standard library dependencies — no pip installs required.
+
+## Scripts
+
+| Script | Language | Purpose |
+|--------|----------|---------|
+| `log-parser.py` | Python 3 | Parse auth.log for failed/successful logins, summarize by IP and user |
+| `backup-validator.sh` | Bash | Verify backup recency, size, and optional checksum integrity |
+| `ioc-checker.py` | Python 3 | Triage IOCs (IPs, domains, hashes) against a local blocklist |
+
+## Usage
+
+All scripts are standalone and self-documenting:
+
+```bash
+# Log analysis
+python3 scripts/log-parser.py --file /var/log/auth.log --format table --top-n 10
+
+# Backup validation
+bash scripts/backup-validator.sh /backup/daily/ 24
+
+# IOC triage
+python3 scripts/ioc-checker.py --ioc-file suspicious.txt --blocklist blocklists/known-bad.txt
+```
+
+Run any script with `--help` or `-h` for full usage details.
+
+## Design Principles
+
+- **No external dependencies.** Python stdlib only, POSIX-compatible Bash. These run on any Linux host without setup.
+- **Structured output.** All scripts support multiple output formats (table, JSON, CSV) for integration with other tools.
+- **Fictional example data.** All IPs, hostnames, and hashes in examples and comments use non-routable or clearly fictional values.

automation/scripts/backup-validator.sh

@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+#
+# backup-validator.sh -- Validate backup recency, size, and integrity.
+#
+# Checks that backup files exist in a target directory, are not older
+# than a configurable threshold, and are not suspiciously small.
+# Optionally verifies file integrity against a SHA-256 checksum file.
+#
+# Usage:
+#   bash backup-validator.sh <backup_dir> [max_age_hours]
+#
+# Examples:
+#   bash backup-validator.sh /backup/daily/
+#   bash backup-validator.sh /backup/daily/ 48
+#   bash backup-validator.sh /backup/weekly/ 168
+#
+# Exit codes:
+#   0 -- All checks passed
+#   1 -- One or more checks failed
+#   2 -- Usage error
+#
+
+set -euo pipefail
+
+DEFAULT_MAX_AGE_HOURS=24
+MIN_FILE_SIZE_BYTES=1024
+CHECKSUM_FILE="checksums.sha256"
+
+if [[ -t 1 ]]; then
+    RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+else
+    RED=''; GREEN=''; YELLOW=''; NC=''
+fi
+
+pass()  { echo -e "  ${GREEN}[PASS]${NC} $*"; }
+fail()  { echo -e "  ${RED}[FAIL]${NC} $*"; FAILURES=$((FAILURES + 1)); }
+warn()  { echo -e "  ${YELLOW}[WARN]${NC} $*"; }
+info()  { echo -e "  [INFO] $*"; }
+
+usage() {
+    echo "Usage: $0 <backup_directory> [max_age_hours]"
+    echo "  backup_directory   Path to the directory containing backup files"
+    echo "  max_age_hours      Maximum acceptable age in hours (default: ${DEFAULT_MAX_AGE_HOURS})"
+    exit 2
+}
+
+if [[ $# -lt 1 ]]; then usage; fi
+
+BACKUP_DIR="$1"
+MAX_AGE_HOURS="${2:-$DEFAULT_MAX_AGE_HOURS}"
+FAILURES=0
+
+echo "============================================"
+echo "  BACKUP VALIDATION REPORT"
+echo "============================================"
+echo ""
+info "Backup directory: ${BACKUP_DIR}"
+info "Max age threshold: ${MAX_AGE_HOURS} hours"
+info "Min file size: ${MIN_FILE_SIZE_BYTES} bytes"
+echo ""
+
+echo "--- Directory Check ---"
+if [[ -d "${BACKUP_DIR}" ]]; then
+    pass "Backup directory exists"
+else
+    fail "Backup directory does not exist: ${BACKUP_DIR}"
+    echo "Result: FAILED (${FAILURES} issue(s))"; exit 1
+fi
+
+echo ""
+echo "--- File Presence Check ---"
+FILE_COUNT=$(find "${BACKUP_DIR}" -maxdepth 1 -type f | wc -l)
+if [[ "${FILE_COUNT}" -gt 0 ]]; then
+    pass "Found ${FILE_COUNT} file(s) in backup directory"
+else
+    fail "Backup directory is empty"
+    echo "Result: FAILED (${FAILURES} issue(s))"; exit 1
+fi
+
+echo ""
+echo "--- File Age Check (max ${MAX_AGE_HOURS}h) ---"
+MAX_AGE_SECONDS=$((MAX_AGE_HOURS * 3600))
+NOW=$(date +%s)
+while IFS= read -r -d '' file; do
+    filename=$(basename "${file}")
+    file_mtime=$(stat -c '%Y' "${file}" 2>/dev/null || stat -f '%m' "${file}" 2>/dev/null)
+    age_seconds=$((NOW - file_mtime))
+    age_hours=$((age_seconds / 3600))
+    if [[ ${age_seconds} -gt ${MAX_AGE_SECONDS} ]]; then
+        fail "${filename} is ${age_hours}h old (threshold: ${MAX_AGE_HOURS}h)"
+    else
+        pass "${filename} is ${age_hours}h old"
+    fi
+done < <(find "${BACKUP_DIR}" -maxdepth 1 -type f -print0)
+
+echo ""
+echo "--- File Size Check (min ${MIN_FILE_SIZE_BYTES} bytes) ---"
+while IFS= read -r -d '' file; do
+    filename=$(basename "${file}")
+    file_size=$(stat -c '%s' "${file}" 2>/dev/null || stat -f '%z' "${file}" 2>/dev/null)
+    if [[ ${file_size} -lt ${MIN_FILE_SIZE_BYTES} ]]; then
+        fail "${filename} is ${file_size} bytes (suspiciously small)"
+    else
+        if [[ ${file_size} -ge 1073741824 ]]; then
+            hr_size="$(echo "scale=1; ${file_size}/1073741824" | bc) GB"
+        elif [[ ${file_size} -ge 1048576 ]]; then
+            hr_size="$(echo "scale=1; ${file_size}/1048576" | bc) MB"
+        elif [[ ${file_size} -ge 1024 ]]; then
+            hr_size="$(echo "scale=1; ${file_size}/1024" | bc) KB"
+        else
+            hr_size="${file_size} bytes"
+        fi
+        pass "${filename} -- ${hr_size}"
+    fi
+done < <(find "${BACKUP_DIR}" -maxdepth 1 -type f -print0)
+
+echo ""
+echo "--- Integrity Check ---"
+CHECKSUM_PATH="${BACKUP_DIR%/}/${CHECKSUM_FILE}"
+if [[ -f "${CHECKSUM_PATH}" ]]; then
+    info "Found checksum file: ${CHECKSUM_FILE}"
+    pushd "${BACKUP_DIR}" > /dev/null
+    if sha256sum --check --quiet "${CHECKSUM_FILE}" 2>/dev/null; then
+        pass "All checksums verified"
+    else
+        fail "Checksum verification failed -- possible corruption"
+    fi
+    popd > /dev/null
+else
+    warn "No checksum file found (${CHECKSUM_FILE}) -- skipping integrity check"
+fi
+
+echo ""
+echo "============================================"
+if [[ ${FAILURES} -eq 0 ]]; then
+    echo -e "  Result: ${GREEN}ALL CHECKS PASSED${NC}"
+else
+    echo -e "  Result: ${RED}FAILED -- ${FAILURES} issue(s) found${NC}"
+fi
+echo "============================================"
+exit $( [[ ${FAILURES} -eq 0 ]] && echo 0 || echo 1 )