The Cyber Homelab
Build notes from a blue team homelab. Everything here is something I actually ran on my own hardware — including the parts that didn't work the first time.
No courses, no modules, no prerequisites. Just documentation you're welcome to follow.
What's here
-
Hardware
The box, the specs, and what I'd buy differently.
-
Hyper-V
Host setup, virtual switches, nested virtualization, and the gotchas that cost me an evening.
-
Active Directory
Domain controller build, GPO, and a realistic enough environment to generate real telemetry.
-
Logging
Sysmon config, Windows event forwarding, and getting it all into a SIEM.
-
Detections
Run a technique, find it in the logs, write the rule. One page per ATT&CK technique.
-
Notes
Scratch pad. Errors, fixes, and things that didn't fit anywhere else.
The lab
A single mini PC running Windows 11 with Hyper-V on top. Everything inside is virtual — domain controller, member server, workstations, firewall, and a SIEM. It's small on purpose: this is what someone can realistically build on a desk without a rack, a UPS, or an understanding spouse.
Hyper-V rather than Proxmox or ESXi, because Windows-heavy environments are what most people walk into on day one, and the concepts port anywhere.
Why blue team
Because that's where the jobs are. The detection engineering side of security is undersupplied with good documentation, and most homelab writeups stop at "I installed the thing." The interesting part starts after that — what the log actually looks like, what the rule misses, what fires at 3am for no reason.
How to use this
Every page stands alone. If you landed here from a search for a specific error, that page should be enough on its own — no need to read anything else first.
Pages carry the versions they were tested against. Homelab guides go stale fast; if something here doesn't match what you're seeing, check the date at the bottom of the page.
Built and broken repeatedly on a single mini PC in a spare room.