Anyone have experience building a Windows AD lab environment in Docker?

• DetectionLab

  31 4,476 4.4 HTML

  Automate the creation of a lab environment complete with security tooling and logging best practices

Since you mention your in-depth ELK workflow, have you tried DetectionLab or Splunk's Attack Range? If you just want a fully working AD domain set up with various hosts, you can spin up the Red Team Attack Lab and then hook in your own logging stuff after it's built.

• attack_range

  12 1,965 7.7 Jinja

  A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

  

Since you mention your in-depth ELK workflow, have you tried DetectionLab or Splunk's Attack Range? If you just want a fully working AD domain set up with various hosts, you can spin up the Red Team Attack Lab and then hook in your own logging stuff after it's built.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• red_team_attack_lab

  5 476 4.5 PowerShell

  Red Team Attack Lab for TTP testing & research

Since you mention your in-depth ELK workflow, have you tried DetectionLab or Splunk's Attack Range? If you just want a fully working AD domain set up with various hosts, you can spin up the Red Team Attack Lab and then hook in your own logging stuff after it's built.

Suggest a related project