Setting Up a Home Lab for Blue Team Practice

Every writeup needs a lab behind it. Here’s the setup I run on a single Proxmox host, and why I chose each piece.

The topology

┌────────────┐     ┌───────────────────────────┐
│  pfSense   │────▶│  LAN segment (management)  │
│ (router)   │     └───────────────────────────┘
└────────────┘              │
        │                   │
  ┌─────┴──────┐    ┌───────┴────────┐
  │ Wazuh      │    │ Victim VMs     │
  │ manager    │    │ Win11, Ubuntu  │
  │ (ELK stack)│    │ (sysmon/auditd)│
  └────────────┘    └────────────────┘

Why these tools

Wazuh — free, has a great agent story for both Windows (Sysmon) and Linux, and ships useful out-of-box rules before you write your own.
pfSense — separates my lab from my home network and logs everything at the perimeter.
Suricata in line with the switch SPAN port gives me network detection practice.

What I practiced first

Getting telemetry flowing: agents → manager → dashboards.
Tuning noise — the hardest part of SOC work, honestly.
Writing my first custom rule: alert on Kerberoasting-style TGS requests (event 4769 with RC4 encryption type).

- rule:
    level: 10
    description: "Possible Kerberoasting via RC4-encrypted TGS request"
    windows:
      - event_id: 4769
    filter:
      - keyword: "rc4_hmac"

Cost & effort

A retired desktop with 64 GB RAM is plenty. Expect an evening to stand it up and a weekend of elbow grease on the telemetry. Totally worth it — everything else on this site is practiced here first.