Multi-Site Zero-Trust SOC with AI-Driven Triage
A self-hosted security operations center protecting multiple home networks across separate physical sites — enterprise-grade monitoring, built and run on commodity hardware, with an AI analyst handling first-line alert triage.
The Problem
Consumer networks have effectively zero security visibility. Across multiple households, there was no central place to see authentication events, software installs, vulnerabilities, or suspicious process activity — and no way to respond before something spread.
The constraint: build something with the rigor of an enterprise SOC, but on commodity hardware, owner-operated, with the data staying on-premises — and without a full-time analyst watching a screen.
Architecture
A hub-and-spoke design: each site runs lightweight endpoint agents that report to a self-hosted SIEM over an encrypted overlay. An always-on node acts as the SOC hub, where an LLM analyst triages alerts and surfaces only what matters.
Approach
- Deployed endpoint agents across sites reporting authentication events, software installs, service changes, vulnerabilities, and process activity to a central self-hosted SIEM.
- Connected sites over a zero-trust WireGuard overlay with a separate break-glass path — no inbound exposure, encrypted end to end.
- Built an AI analyst layer that queries the alert store, triages noise from signal, and produces plain-language investigations on demand — so monitoring scales without a human watching dashboards.
- Tuned detection rules and tested them safely before promotion, treating the SOC config as version-controlled infrastructure.
Outcomes
- 3 — Sites monitored
- 24/7 — Continuous coverage
- ~$6–7/mo — Total run cost
- Minutes — Alert → investigation