clong/DetectionLab
DetectionLab
DetectionLab is a reproducible Windows Active Directory security lab designed for testing detection capabilities. It uses an automation framework based on Vagrant and Packer to provision virtualized networks across multiple hypervisors and cloud platforms.
The project utilizes Ansible for the declarative installation and configuration of domain services and endpoint security tools. It incorporates a browser-based remote access interface via Apache Guacamole to manage laboratory hosts without requiring standalone remote desktop clients.
The environment includes a telemetry pipeline that aggregates Sysmon and Windows Event Logs from multiple hosts into a single analysis point. It further covers endpoint monitoring, network traffic analysis, and data forwarding to security information and event management systems.
Features
- Windows Domain Detection Labs - Deploys a pre-configured Windows Active Directory environment specifically designed for testing security detection capabilities.
- Lab Provisioning Automation - Uses Packer and Vagrant to automate the provisioning of multi-machine security laboratory environments.
- Ansible Playbooks - Provides declarative playbooks to automate the installation of security tools and Active Directory services.
- Vagrant Multi-Provider Orchestrators - Provides an automation framework using Vagrant and Packer to provision virtualized networks across multiple hypervisors and cloud platforms.
- Windows Domain Detection Testing - Creates a realistic Windows Active Directory environment specifically to verify security alerts and detection rules.
- Centralized Logging Systems - Aggregates system logs and security telemetry from multiple endpoints into a single central analysis point.
- Distributed Security Event Aggregation - Centralizes security logs and telemetry from multiple distributed hosts into a single analysis point.
- Windows Event - Implements a telemetry pipeline that aggregates native Sysmon and Windows Event Logs from multiple hosts.
- Windows Endpoint Monitoring - Configures system auditing and telemetry tools like Sysmon and OSQuery to track detailed activity across hosts.
- Browser-Based Remote Desktops - Provides a browser-based remote access interface via Apache Guacamole for interacting with laboratory hosts.
- Cloud Security Lab Provisioning - Provides infrastructure-as-code provisioning for cloud-based Windows security environments with Active Directory setups.
- Hypervisor-Specific Lab Provisioning - Implements infrastructure-as-code tooling for provisioning security laboratory environments specifically on ESXi hypervisors.
- Cross-Hypervisor Orchestration - Abstracts virtualization layers to deploy a single configuration across VirtualBox, VMware, Hyper-V, and cloud platforms.
- Internal Lab Networks - Creates isolated private networks for virtual lab environments using virtual switches to contain security traffic.
- Endpoint Auditing Configurations - Implements advanced auditing and transcript logging to capture detailed system and process activity on endpoints.
- Browser-Based Remote Desktop Clients - Implements a web-based interface via Apache Guacamole for managing laboratory hosts without native RDP clients.
- Centralized Environment Visibility - Provides a centralized connection system that links all hosts to a single server for unified environment visibility.
- Browser-Accessible Labs - Offers a centralized web gateway for remote desktop access to all hosts within the security laboratory.
- System Activity Monitoring - Tracks system processes and events using monitoring tools and custom auditing configurations.
- Detection Labs - Automated lab setup for security tooling and logging practice.
- DevSecOps and Automation - Automated lab environment for security tooling.
- Detection and Hunting Tools - Automated lab environment setup for security tooling and logging.
- Lab Environments - Automated lab environment with security tooling.
- Security Tools - Listed in the “Security Tools” section of the Awesome Hacking awesome list.
