Labshock Documentation

If you run Labshock without a license, it operates in trial mode. There is no license required to start, but the following limitations apply:

• Initialization Delay: 5-minute delay at startup.
• Session Limit: 40-minute session limit per run.
• Restarts: Unlimited restarts are allowed.

Labshock is deployed using a multi-service Docker Compose architecture that simulates an industrial cyber environment. The deployment includes a central portal, network routers, SCADA components, security tools (IDS, collectors), and optional IT monitoring stacks (Splunk or ELK).

Most services require specific network capabilities (NET_ADMIN, NET_RAW) and are segmented into distinct virtual networks to simulate real-world network isolation (L2, L3 SCADA, L3 Security, DMZ, etc.).

# To deploy the core Labshock environment, use the provided docker-compose.yml
docker compose up

# To include optional IT monitoring stacks, use profiles:
# For Splunk:
docker compose --profile it-splunk up

# For ELK (Elasticsearch, Kibana, Logstash):
docker compose --profile it-elk up

Labshock is designed to test detection logic by forwarding real OT telemetry to a SIEM.

• Supported Integrations: Ready-made support for Splunk and ELK.
• Data Flow: The Tidal Collector gathers events from OpenPLC, SCADA, and IDS, then normalizes and forwards them to your SIEM.
• Use Case: Use this to test SIEM rules, log normalization, and correlation of security-relevant signals in an industrial context.

Labshock is an OT security learning platform that runs on Docker.

System Requirements

• Minimum: 2 CPUs, 2GB RAM, 10GB HDD
• Recommended: 4 CPUs, 8GB RAM, 20GB HDD

Installation

For detailed setup instructions, refer to the Quickstart Guide.

# Refer to the Quickstart Guide for specific commands

Labshock can be deployed using a docker-compose.yml file which orchestrates the portal and launcher services. The deployment relies on a bridge network named portal_network and a named volume portal-data for persistent configuration.

name: labshock

networks:
  portal_network:
    driver: bridge

services:
  portal:
    image: zakharbz/labshock-portal:latest
    ports:
      - '443:443'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portal-data:/app/config/
    networks:
      - portal_network

  launcher:
    image: zakharbz/labshock-launcher:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./docker-compose.yml:/data/docker-compose.yml:ro
    command: ["tail", "-f", "/dev/null"]

volumes:
  portal-data:

The launcher service is used for orchestration tasks. It operates with read-only access to the Docker socket and the compose file.

Key Settings:

• Image: zakharbz/labshock-launcher:latest
• Volumes:
  • /var/run/docker.sock:/var/run/docker.sock:ro: Read-only access to the Docker daemon.
  • ./docker-compose.yml:/data/docker-compose.yml:ro: Read-only access to the local deployment configuration.
• Command: Runs tail -f /dev/null to keep the container alive.

The it-elk profile enables an Elastic Stack (Elasticsearch, Kibana, and Logstash) for IT-level monitoring.

Elasticsearch Configuration

• discovery.type: Set to single-node.
• xpack.security.enabled: Set to false.
• ES_JAVA_OPTS: Configures heap size (e.g., -Xms1g -Xmx1g).
• Port: Accessible via host port 9200.

Kibana Configuration

• ELASTICSEARCH_HOSTS: Must point to the Elasticsearch service (e.g., http://elasticsearch:9200).
• Port: Accessible via host port 9443 (mapped to container 5601).

elasticsearch:
  environment:
    - discovery.type=single-node
    - xpack.security.enabled=false
    - ES_JAVA_OPTS=-Xms1g -Xmx1g

kibana:
  environment:
    ELASTICSEARCH_HOSTS: http://elasticsearch:9200
  ports:
    - "9443:5601"

The portal service provides the main interface. It requires access to the Docker socket to manage containers and uses a named volume for configuration persistence.

Key Settings:

• Image: zakharbz/labshock-portal:latest
• Ports: Maps host port 443 to container port 443 (HTTPS).
• Volumes:
  • /var/run/docker.sock:/var/run/docker.sock: Grants the portal access to the Docker daemon.
  • portal-data:/app/config/: Persistent storage for portal configuration files.
• Network: Connects to portal_network.

The it-splunk profile enables a Splunk instance for IT-level monitoring. It requires the following configuration:

• SPLUNK_START_ARGS: Must include --accept-license.
• SPLUNK_GENERAL_TERMS: Must include --accept-sgt-current-at-splunk-com.
• SPLUNK_PASSWORD: The administrative password for Splunk (default in compose is labshock).
• Port: Accessible via host port 8443 (mapped to container 8000).

it-splunk:
  image: splunk/splunk:10.0
  environment:
    - SPLUNK_START_ARGS=--accept-license
    - SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com
    - SPLUNK_PASSWORD=labshock
  ports:
    - "8443:8000"

The portal service is the central management component. It can be configured using the following environment variables:

• PORTAL_VERSION: Specifies the version of the portal (e.g., 2.0.0).
• PLATFORM_URL: The base URL for the Labshock platform (e.g., https://world.labshocksecurity.com).

portal:
  environment:
    PORTAL_VERSION: 2.0.0
    PLATFORM_URL: https://world.labshocksecurity.com

The PLC service supports all five languages defined in the IEC 61131-3 standard:

• LD (Ladder Logic)
• IL (Instruction List)
• ST (Structured Text)
• FBD (Function Block Diagram)
• SFC (Sequential Function Chart)