DOCSEARCHbyAlgolia
Submit Docs

Detection Lab Documentation

repository·master·Indexed 26 days ago

https://github.com/clong/detectionlab

A pre-configured Windows domain environment for security defenders to practice detection engineering and monitoring. It automates the deployment of security tools including Splunk, Sysmon, osquery, Zeek, Suricata, and Microsoft Advanced Threat Analytics. Supports deployment across various platforms including AWS, Azure, ESXi, Proxmox, Hyper-V, and local virtualization via VirtualBox or VMware.

Tokens
3.1K
Snippets
6
Records
26
Agent score
90%

What's inside Detection Lab

  1. Overview of Detection Lab features

    master

    Detection Lab is a pre-configured Windows domain designed for defenders to practice security monitoring and introspection. It includes several integrated security tools and logging configurations:

    • Microsoft Advanced Threat Analytics (ATA): Installed on the WEF machine with a lightweight ATA gateway on the DC.
    • Splunk: Pre-installed with forwarders, pre-created indexes, and configured Technology Add-ons.
    • Windows Auditing: Custom GPO configuration for command line process auditing and OS-level logging.
    • Windows Event Forwarding (WEF): Implements Palantir's WEF subscriptions and custom channels.
    • PowerShell Logging: Transcript logging is enabled; logs are stored at \wef\pslogs.
    • osquery & Fleet: osquery is installed on all hosts and configured to connect to a Fleet server via TLS (using Palantir's osquery configuration).
    • Sysmon: Installed and configured using Olaf Hartong's sysmon-modular configuration.
    • Autoruns Logging: All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog.
    • Network Monitoring: Zeek and Suricata are pre-configured for network traffic monitoring and alerting.
    • Remote Access: Apache Guacamole is installed for browser-based access to all hosts.

  3. Select Virtual Switch during build

    master

    You must manually select a virtual switch for each server during the build process. Forcing a specific switch via configuration is currently unsupported as it breaks the build.

    Workaround for automation: If you have configured smb_username and smb_password in your Vagrantfile, you can attempt to automate the switch selection by pressing the option number for your desired switch followed by enter four times immediately after running vagrant up.

  4. Deployment options for Detection Lab

    master

    Detection Lab can be deployed across various environments. Detailed deployment guides are available for the following platforms:

    • Virtualization (Local):
      • MacOS (VirtualBox or VMware Fusion)
      • Windows (VirtualBox or VMware Workstation)
      • Linux (VirtualBox or VMware Workstation)
      • HyperV
      • LibVirt
      • Proxmox
    • Cloud & Infrastructure (via Terraform & Ansible):
      • AWS
      • Azure
      • ESXi

  8. Requirements for Detection Lab on Hyper-V

    master

    To run Detection Lab on Hyper-V, ensure your environment meets the following criteria:

    • Hyper-V Version: Must be compatible with Hyper-V VM configuration version 9.0.
    • Supported Operating Systems:
      • Windows 10 1809 or later
      • Windows Server 2019
      • Windows Hyper-V Server 2019
    • Required Plugins: vagrant-reload (the build will prompt for installation if missing).

  9. Build DetectionLab on Azure

    master

    To deploy DetectionLab on Microsoft Azure, follow the official deployment documentation. Note that as of 2023-01-01, DetectionLab is no longer being actively maintained.

    Documentation: https://www.detectionlab.network/deployment/azure/

  10. Prepare your system for building Detection Lab

    master

    Before building Detection Lab locally, you must run the prerequisite check scripts located in the Vagrant folder. These scripts ensure your system meets the necessary requirements for the build process.

    Use the following scripts based on your operating system:

    • Shell: prepare.sh
    • PowerShell: prepare.ps1

  11. Estimate DetectionLab AWS deployment costs

    master

    You can estimate the hourly and monthly costs of your DetectionLab AWS deployment by piping your terraform state to the cost estimation service. This provides an estimate of the infrastructure expenses.

    terraform state pull | curl -s -X POST -H "Content-Type: application/json" -d @- https://cost.modules.tf/

  12. Configure SMB Credentials in Vagrantfile

    master

    Because Windows requires administrator credentials to create and mount SMB shares, the build is not fully automated. You can avoid manual password entry (which occurs at least twice per machine) by adding credentials directly to your Vagrantfile on line 2.

    Warning: This stores credentials in plaintext and is not recommended for production or shared environments.

    config.vm.synced_folder '../Vagrant', '/vagrant', smb_username: "username", smb_password: "password"