Historical archive
This page summarises the first version of the lab, not its current state. See the rebuild and current architecture.
Original architecture
A ThinkCentre M910q running Proxmox hosted the VMs on a single network behind pfSense. The ThinkPad X230 was used for administration.
| Component | Role |
|---|---|
| pfSense | Routing and lab isolation |
| Wazuh on Ubuntu Server | Event collection and analysis |
| Windows Server 2022 with Wazuh agent | Monitored host |
| Kali Linux | Attack exercises and access to tools |
Completed exercise
A simulated RDP brute-force attack using Hydra produced 175 Windows 4625 events in under 60 seconds, found in Wazuh.
The exercise helped me practise failed-authentication analysis and incident reporting: read the RDP investigation.
Evolution
The October 2026 rebuild replaces this flat network with two Proxmox hosts and multiple VLANs. Current services, validations and next steps are documented in Homelab Rebuild.