I’m rebuilding my lab to learn how to administer a segmented network and analyse its security events.
This page describes the architecture and current state. Changes and technical solutions belong in the build journal; alert analysis belongs in the published write-ups.
Validated state — 18 October 2026
Two Proxmox hosts are operational. DC01 hosts Active Directory and DNS for ad.lab.internal. Its Wazuh agent is active: it is the only deployed agent, and an AD account creation has been found in the SIEM.
| Host | Current hardware and storage | Services |
|---|---|---|
| pve1 — M910q | 16 GB RAM, Samsung PM981a 512 GB NVMe | DC01: Windows Server 2025, AD DS, DNS |
| pve2 — M920q | i5-8500T, 32 GB RAM, Samsung PM981a 512 GB NVMe | pfSense and Wazuh; separate SATA 512 GB backup disk |
Both hosts use Proxmox VE 9.2, ext4 and LVM-thin. The old M910q SSD was replaced; the M920q’s 1 TB NVMe was removed for another project.
Network architecture
The Beryl AX separates the lab from the home network. The NETGEAR GS308E switch carries VLANs to both hosts; pfSense handles routing and filtering.
| Zone | Network | Current or planned use |
|---|---|---|
| ADMIN — VLAN 1 | 192.168.8.0/24 | Management, pve1 (.10), pve2 (.11) |
| SERVERS — VLAN 20 | 10.0.20.0/24 | DC01: 10.0.20.10 |
| CLIENTS — VLAN 30 | 10.0.30.0/24 | Windows 11 planned |
| ATTACK — VLAN 40 | 10.0.40.0/24 | Attack exercises planned |
| SOC — VLAN 50 | 10.0.50.0/24 | Wazuh: 10.0.50.10; TheHive planned |
| DMZ — VLAN 60 | 10.0.60.0/24 | Linux server planned |
Validated collection: DC01 → Wazuh agent → pfSense → Wazuh.
A rule restricted to DC01 → Wazuh on TCP 1514–1515, above the RFC1918 block, allows agent communication and enrollment. Both ports were tested. This does not open management interfaces to all VLANs; flows for the future Windows workstation remain to be defined.
First SOC investigation — 4720
I created a disabled test account, soc.wazuh, then found its 4720 event in Wazuh Threat Hunting: DC01 (001) agent, Windows Security log, alert level 8, actor AD\Administrateur.
Conclusion: authorised administrative activity, not a compromise. An alert’s severity must be interpreted in context.
Account creation 4720 and deletion 4726 events were also verified locally with soc.test, deleted at the end of the exercise. Cleanup of soc.wazuh still needs confirmation.
Checks and limitations
- Active Directory: domain, services, SYSVOL/NETLOGON shares and DNS resolution checked. Targeted Advertising and SysVolCheck tests pass; historical DNS/DFSR warnings still need review.
- Security: OUs, fictional standard accounts, groups, password policy and audit GPO configured. Kerberos auditing is enabled, but the associated exercises remain planned.
- Backups: pfSense and Wazuh restored from verified archives. Weekly job, four copies retained on pve2’s SATA disk. Same physical host: this is not an external backup. DC01 is not included yet.
Rebuild milestones
M920q migration — 17 October 2026
Replaced the NVMe, reinstalled with ext4/LVM-thin and restored pfSense and Wazuh. Networking, dashboard access and automatic startup checked.
M910q returned to service — 18 October 2026
Replaced the SSD after the ZFS incidents, then installed DC01 and its Wazuh agent. The PM981a shows 3% wear and no data-integrity errors; NVMe command errors remain under observation.
Key milestones and completed checks are summarised in the build journal.
The first version of the lab remains available as a historical archive.