ENTERPRISE INFRASTRUCTURE • SOC • DETECTION ENGINEERING

Enterprise Active Directory & SOC Environment

A segmented enterprise-style Windows infrastructure integrating Active Directory, pfSense, Splunk Enterprise, Sysmon, Snort IDS, and controlled security testing.

I designed, built, secured, monitored, tested, and troubleshot a multi-network enterprise lab to develop practical experience across systems administration, network security, SIEM engineering, detection development, IDS monitoring, and security investigation.

View GitHub Repository Back to Projects

Project Snapshot

Identity

Active Directory Domain Services, two domain controllers, DNS, users, groups, Organizational Units, and Group Policy.

Network Security

pfSense routing, DHCP, NAT, segmentation, firewall policy, DMZ controls, and isolated testing networks.

Security Monitoring

Splunk Enterprise, Universal Forwarders, Windows Security Logs, Sysmon, pfSense logs, Snort IDS events, dashboards, and alerts.

Detection Engineering

Authentication monitoring, suspicious PowerShell, discovery activity, account changes, privileged-group changes, and security alerts.

Endpoint Telemetry

Sysmon telemetry for process execution, network activity, command lines, and other endpoint security events.

Security Testing

Controlled testing with Kali Linux to validate firewall rules, IDS visibility, logging, and detection coverage.

Virtual Lab Environment

The environment was built in VMware Workstation and separated into dedicated network segments to simulate enterprise infrastructure.

                         VMware Workstation
                                |
                             pfSense
                                |
       ---------------------------------------------------
       |             |             |          |          |
     SERVERS       CLIENTS     MANAGEMENT     DMZ      EXTERNAL
  172.16.10.0/24 172.16.20.0/24 172.16.30.0/24
                                            172.16.40.0/24
                                                       172.16.50.0/24

SERVERS
-----------------------------------------------------------
DC01       172.16.10.10    Active Directory / DNS
DC02       172.16.10.11    Secondary DC / DNS / GC
SPLUNK01   172.16.10.30    Splunk Enterprise

CLIENTS
-----------------------------------------------------------
Client     172.16.20.101   Domain workstation

EXTERNAL
-----------------------------------------------------------
Kali       172.16.50.10    Authorized security-testing host

VMware Workstation enterprise security lab containing pfSense, Windows Server, management, client, DC02, Splunk and Kali systems — VMware Workstation environment containing the core enterprise, monitoring, firewall, client, and security-testing systems.

Active Directory Infrastructure

The Windows environment was built around the corp.local Active Directory domain.

A structured Organizational Unit hierarchy was created for administrative roles, users, servers, clients, management systems, service accounts, and business departments.

Active Directory Users and Computers organizational unit structure — Active Directory OU structure used to organize users, systems, administrators, service accounts, and departments.

Active Directory domain controllers DC01 and DC02 — DC01 and DC02 deployed as domain controllers to provide directory-service redundancy.

Group Policy Administration

Group Policy was used to centrally manage domain security, administrative restrictions, endpoint configuration, mapped drives, and Splunk deployment tasks.

Group Policy Management console showing enterprise GPOs — Group Policy Objects used for password policy, domain-controller policy, Splunk deployment, local-administrator restrictions, drive mapping, and administrative controls.

Windows File Services

Windows Server file services were used for domain resources and deployment infrastructure.

Windows Server file and storage services shares — Windows Server shares including NETLOGON, SYSVOL, and the Splunk deployment share.

Network Segmentation with pfSense

pfSense acted as the central router, firewall, DHCP service, and security boundary between the enterprise network segments.

Routing DHCP NAT Firewall Rules Segmentation DMZ External Testing

pfSense DHCP interfaces and LAN DHCP configuration — pfSense interface and DHCP configuration for the segmented enterprise lab networks.

NETWORK SECURITY

Firewall Security Policy

pfSense was used as the central security boundary between the lab's network segments.

Firewall policies controlled traffic between trusted enterprise systems, client networks, management infrastructure, the DMZ, the external testing network, and the WAN.

The rules were designed around segmentation and controlled access instead of unrestricted inter-subnet communication.

LAN Policy

The LAN provides connectivity for core server infrastructure while pfSense acts as the gateway between the server network and other security zones.

DMZ Isolation

DMZ firewall rules restrict access toward internal client, management, and server networks while permitting only explicitly required traffic.

External Testing Network

The external network provides an isolated location for authorized Kali Linux security testing.

WAN Protection

Unsolicited inbound WAN traffic is denied by default, providing a restrictive external security boundary.

LAN Firewall Policy

The LAN interface contains the core server-side network policy. pfSense provides gateway services for the segment while controlling traffic as it moves between security zones.

pfSense LAN firewall rules protecting the enterprise server network — pfSense LAN firewall configuration showing the interface policy applied to the enterprise server network.

pfSense DMZ firewall rules restricting access to internal networks — DMZ security policy restricting access toward internal management, client, and LAN resources.

pfSense external network firewall policy controlling Kali Linux access — External security-testing policy controlling communication from the isolated testing network toward internal resources.

WAN Firewall Policy

The WAN interface follows a default-deny inbound security model. Private and bogon source networks are blocked and no general inbound pass rule is exposed through the WAN.

pfSense WAN firewall rules using a default deny inbound security policy — WAN firewall policy showing private-network and bogon filtering with unsolicited inbound connections blocked by default.

Segmentation Strategy

                         INTERNET / WAN
                              |
                              v
                         +-----------+
                         |  pfSense  |
                         | Firewall  |
                         +-----------+
                              |
          -------------------------------------------------
          |             |             |          |        |
          v             v             v          v        v

       SERVERS        CLIENTS      MANAGEMENT    DMZ    EXTERNAL
    172.16.10.0/24  172.16.20.0/24 172.16.30.0/24
                                             172.16.40.0/24
                                                       172.16.50.0/24

          |             |             |          |        |
          +-------------+-------------+----------+--------+
                              |
                         Firewall Policy
                              |
               Allow only permitted communication
                              |
                   Log security-relevant traffic
                              |
                 +------------+------------+
                 |                         |
                 v                         v
              Snort IDS                Splunk SIEM
                 |                         |
                 +------------+------------+
                              |
                              v
                    Detection & Investigation

This architecture allowed network activity to be evaluated at multiple defensive layers. pfSense enforced network policy, Snort inspected traffic for suspicious patterns, and Splunk centralized resulting telemetry for detection, correlation, and investigation.

Centralized Security Monitoring with Splunk

Splunk Enterprise was used as the central SIEM platform for Windows, Active Directory, Sysmon, pfSense, and Snort telemetry.

I created the CORP SOC Security Overview to consolidate host activity, authentication events, Active Directory changes, detections, firewall activity, and IDS alerts.

Splunk CORP SOC Security Overview dashboard — SOC overview showing total security events, failed authentication attempts, AD changes, account lockouts, suspicious PowerShell, privileged-group changes, and triggered detections.

Splunk security events and failed logons by host — Host-level security events, failed logons, Sysmon activity, and pfSense event volume.

Splunk firewall and Snort monitoring dashboard — Firewall block analysis, top source and destination IPs, blocked protocols, and Snort IDS alert metrics.

Detection Engineering

I created SPL searches and alerts to identify suspicious authentication, account activity, discovery behavior, PowerShell execution, and other security events.

Authentication

Failed login attempts, account lockouts, Kerberos failures, NTLM failures, and suspicious authentication patterns.

Identity Changes

New user creation, account enable/disable activity, local-account changes, and privileged-group membership changes.

Execution

Suspicious PowerShell, encoded PowerShell, CMD execution, and living-off-the-land binary activity.

Discovery

Account discovery, process discovery, network configuration discovery, and Windows discovery commands.

Persistence

Scheduled-task activity and other high-interest system changes.

Network Detection

Snort IDS detections, firewall blocks, reconnaissance, and suspicious network activity.

Splunk triggered detections dashboard — Triggered detection activity and recent high-interest security events in Splunk.

SPL Detection Logic

The project included developing and validating SPL rather than relying entirely on built-in dashboards.

Splunk SPL query detecting multiple failed logons followed by success — SPL logic designed to identify repeated failed logons followed by a successful authentication within a defined time window.

Security Alert Library

Detection searches were converted into reusable Splunk alerts so suspicious activity could be continuously evaluated.

Splunk alert library containing Active Directory and endpoint security alerts — Splunk alert library containing authentication, identity, PowerShell, LOLBIN, discovery, and account-security detections.

Snort IDS Integration

Snort was deployed on pfSense to add network intrusion-detection telemetry to the lab.

IDS events were generated, reviewed directly in pfSense, and forwarded into Splunk for centralized investigation.

Snort IDS interface running on the clients network — Snort monitoring the CLIENTS network interface.

Snort IDS alerts detecting portscan activity — Snort alert log showing detected UDP filtered port-sweep activity.

Splunk Snort IDS security monitoring dashboard — Dedicated Splunk Snort IDS dashboard showing alert volume, portscan detections, source IPs, signatures, destinations, and activity over time.

Splunk Snort IDS dashboard showing recent detections and alert activity — Recent Snort detections and IDS activity centralized inside Splunk for investigation.

Security Testing & Validation

Kali Linux was used only inside the authorized lab environment to validate defensive controls and monitoring visibility.

Authorized Test Activity
        |
        v
     Kali Linux
        |
        v
   pfSense Firewall
        |
        +------> Firewall Logs
        |
        +------> Snort IDS
        |
        v
  Windows / AD Systems
        |
        +------> Windows Security Events
        |
        +------> Sysmon Telemetry
        |
        v
   Splunk Enterprise
        |
        +------> Searches
        +------> Detections
        +------> Alerts
        +------> Dashboards
        +------> Investigation

Troubleshooting Experience

Building the environment required troubleshooting across multiple infrastructure and security layers.

Networking

Routing, IP addressing, VMware virtual networks, pfSense rules, NAT, DHCP, and connectivity.

Active Directory

Domain membership, DNS, Group Policy processing, service accounts, and replication.

Splunk

Universal Forwarder connectivity, indexes, source types, log ingestion, searches, parsing, and dashboards.

Security Telemetry

Sysmon visibility, Windows event collection, pfSense syslog, and Snort IDS ingestion.

Detection Logic

SPL validation, zero-result searches, alert conditions, event interpretation, and detection tuning.

System Resources

VM memory allocation, service availability, system startup, and multi-VM lab performance.

Final Results

Enterprise Identity

Operational multi-domain-controller Active Directory environment.

Segmentation

Multiple security zones enforced through pfSense.

Centralized SIEM

Windows, Sysmon, firewall, and IDS telemetry centralized in Splunk.

Detection Coverage

Custom searches, alerts, dashboards, and detection logic implemented.

Network IDS

Snort IDS deployed and integrated with Splunk monitoring.

Validated Security Controls

Authorized testing confirmed firewall, logging, IDS, and SIEM visibility.

Skills Demonstrated

Windows Server Active Directory Domain Controllers DNS Group Policy VMware Workstation TCP/IP Routing DHCP NAT Network Segmentation pfSense Firewall Administration Splunk Enterprise Universal Forwarder SPL Dashboards Alerts Sysmon Snort IDS Detection Engineering Log Analysis Threat Investigation Kali Linux Security Testing Troubleshooting Technical Documentation

Full Technical Documentation

The GitHub repository contains additional implementation details, configuration evidence, troubleshooting notes, and supporting technical documentation for this project.

View GitHub Repository Back to Projects