# Self-Hosted Security Lab

A local Docker-based security lab that runs **MISP** (threat intelligence), **n8n** (workflow automation), and **Splunk** (SIEM / logging) on a shared Docker network. Use it to ingest and correlate threat indicators, automate enrichment (e.g. VirusTotal, URLScan), and send events to Splunk for search and alerting.

## What’s in this repo

| Directory | What it does |
|-----------|----------------|
| **misp** | Deploys [MISP](https://www.misp-project.org/) (Malware Information Sharing Platform) via the official misp-docker stack. Configures threat feeds (CIRCL, Botvrij, abuse.ch), generates an API key for n8n, and attaches MISP to the `security-lab` network so n8n can call `https://misp-core:443`. |
| **n8n** | Deploys [n8n](https://n8n.io/) on the same `security-lab` network. Use it to build workflows that query MISP, call external APIs (VirusTotal, URLScan), and send enriched data to Splunk via HEC. |
| **splunk** | Deploys Splunk in Docker with a `threat_intel` index and HEC enabled. Includes scripts to ingest IOCs (TweetFeed RSS, MalwareBazaar CSV, sample ThreatFox/URLhaus/email data) and to simulate firewall alerts that can trigger n8n enrichment. |

Together, these form a small **threat-intel + automation + SIEM** pipeline: MISP holds IOCs and feeds, n8n orchestrates enrichment and integration, and Splunk stores and searches events.

## Prerequisites

- **Docker Desktop** (or Docker Engine + Docker Compose)
- **Git** (for MISP deployment, which clones misp-docker )
- Ports available:
  - MISP: **8443** (HTTPS), **10080** (HTTP)
  - n8n: **5678**
  - Splunk: **8000** (Web), **8088** (HEC), **8089** (API)

## Quick start (recommended order)

From the repo root you can deploy everything in one go (n8n → MISP → Splunk):

```bash
chmod +x run_all.sh
./run_all.sh
```

Or deploy each component manually in this order:

1. **Create the shared network** (optional; deploy scripts can create it):
   ```bash
   docker network create security-lab
   ```

2. **Deploy n8n** (creates `security-lab` network; workflows can later reach MISP and Splunk):
   ```bash
   cd n8n && chmod +x deploy_n8n.sh && ./deploy_n8n.sh
   ```

3. **Deploy MISP** (clones repo, configures feeds, writes API key to `misp/misp_api_key.txt`):
   ```bash
   cd misp && chmod +x deploy_misp.sh && ./deploy_misp.sh
   ```

4. **Deploy Splunk** (creates `threat_intel` index, enables HEC, writes token to `splunk/splunk_hec_token.txt`):
   ```bash
   cd splunk && chmod +x deploy_splunk.sh && ./deploy_splunk.sh
   ```

After that:

- **MISP:** https://localhost:8443 — user `admin@admin.test` / password `admin`; API key in `misp/misp_api_key.txt`.
- **n8n:** http://localhost:5678 — use MISP credential with base URL `https://misp-core:443` and “Allow Unauthorized Certs” enabled.
- **Splunk:** http://localhost:8000 — user `admin`; HEC token in `splunk/splunk_hec_token.txt`.

## How they work together

- **MISP ↔ n8n:** n8n runs on the `security-lab` network and calls MISP at `https://misp-core:443` using the API key from `misp/misp_api_key.txt`. Use n8n to search MISP, create events, or sync IOCs.
- **n8n ↔ Splunk:** Use Splunk’s HTTP Event Collector (HEC) from n8n (or from the provided Python scripts) to send events to the `threat_intel` index. Token is in `splunk/splunk_hec_token.txt`.
- **Scripts in splunk:**  
  - `simulate_firewall_alert.py` sends a fake firewall alert (with a URL IOC) to Splunk and can call an n8n webhook for enrichment.  
  - Scripts under `ingest_iocs/` pull IOCs from TweetFeed RSS, MalwareBazaar CSV, or hardcoded samples and send them to Splunk via HEC.

All three stacks use the same Docker network (`security-lab`) so containers can talk by service name (e.g. `misp-core`, `splunk`).

## Destroy and re-deploy

From the repo root, tear down all components (Splunk → MISP → n8n) in one go:

```bash
chmod +x destroy_all.sh
./destroy_all.sh
```

Or destroy each component individually:

```bash
# Splunk: removes container and volumes
./splunk/deploy_splunk.sh destroy

# MISP: removes containers, volumes, and the cloned misp-docker directory
./misp/deploy_misp.sh destroy

# n8n: removes container and volume
./n8n/deploy_n8n.sh destroy
```

After destroy, run `./run_all.sh` (or the individual deploy scripts) again for a clean install.

## More detail

- **[misp/README.md](misp/README.md)** — MISP deploy, env vars, threat feeds, API key, n8n integration.
- **[n8n/README.md](n8n/README.md)** — n8n deploy, `security-lab` network, MISP credential setup.
- **[splunk/README.md](splunk/README.md)** — Splunk deploy, HEC, and all ingestion/simulation scripts.
