Phase 5 of the Argus SOC build — hardening across all nodes, retiring the Pi 3B+, bringing a ThinkCentre M920x online as the new client infrastructure with Proxmox and an Active Directory domain, migrating the edge-sensor role to the Pi 5, and tuning the AI triage layer for the new environment.

Phase 4 Scenario 5 of the Argus SOC build — pivoting from a compromised Metasploitable host into the Cowrie honeypot. The detection rules fire correctly, but Claude misclassifies the alert as LOW. The first scenario where the AI triage layer — not the detection layer — was the weak link.

Phase 4 Scenario 4 of the Argus SOC build — SQLmap dumps the DVWA database through four injection techniques. Suricata sees nothing because HTTP_PORTS only covers port 80. After adding 8080 and writing custom rules, the same attack generates 33 alerts.

Phase 4 Scenario 3 of the Argus SOC build — Metasploit exploits the UnrealIRCd backdoor for a root shell. The SOC sees nothing. Zero alerts, zero detection. Then the root cause is found, custom rules are written, and the re-test produces 12 CRITICAL alerts.

Phase 4 Scenario 2 of the Argus SOC build — running Hydra against the Cowrie SSH honeypot. The first scenario where the full detection pipeline fires end-to-end: attack → Cowrie capture → Wazuh → Claude triage → Telegram alert.

Phase 4 Scenario 1 of the Argus SOC build — running aggressive and stealth Nmap scans against the lab, analyzing what the detection stack caught and what it missed, then fixing the root cause and re-testing.

Phase 3 of the Argus SOC build — deploying Velociraptor for live endpoint forensics and building the Grafana SOC dashboard. A real SSH brute force incident gets detected and blocked during the build.

Phase 2 of the Argus SOC build — deploying Cowrie SSH honeypot on the Pi 3B+. Port 22 becomes a trap. Every credential brute-forced, every command typed, every file an attacker tries to download is logged and forwarded to Wazuh.

Phase 1 of the Argus SOC build — wiring up the AI triage pipeline. Every Wazuh alert gets classified by Claude, routed by severity, and delivered as a formatted Telegram notification with PagerDuty escalation for critical events.

Phase 0 Part 2 — deploying the full Wazuh stack on Hetzner, wiring up the Suricata and Zeek detection engines, and standing up the vulnerable attack targets. Phase 0 verification checkpoint passed.