Journal

Build notes, walkthroughs and the questions that made me add each piece of the lab.

Lab walkthroughsKali Red and Blue: four tests worked from both sidesNmap, Burp Suite, Metasploit and Wireshark on the red side; captures, Windows events, Wazuh and CoPilot on the blue side.

14 entries

DetectionDetection and response notes3 min read
Asking Splunk and Defender for Endpoint the same question
I explored an additional Splunk instance alongside a Microsoft Defender for Endpoint free trial. Looking at one redacted scenario from both sides shows what each data source reveals and what it misses.
Private accessPrivate access and GRC3 min read
Comparing who can reach what with Twingate and NetBird
Getting onto my lab network was only half the question. I wanted to explain which person or device could reach a particular service, and why. Twingate and NetBird gave me two ways to think about that boundary.
DetectionDetection and response notes5 min read
Designing a SIEM path from Windows events to a CoPilot case
The detection design I am building toward: how a failed logon on a Windows endpoint would travel through Wazuh into a SOCFortress CoPilot alert and case, and what I check at each hand-off.
Active DirectoryThe Active Directory lab2 min read
Designing domain-account Wi-Fi with 802.1X and NPS
An example of how Active Directory could decide who joins a wireless network, without handing out a shared password. It is a design I can test, not a setup I have deployed.
InfrastructureGrowing the infrastructure4 min read
Following a packet through my Proxmox bridges and Sophos
I traced one connection from the laptop's uplink through three Proxmox bridges and Sophos. This is the map I use to explain where each rule applies, and where traffic never meets the firewall at all.
OriginsHow the lab began8 min read
Hosting Minecraft behind CGNAT for five friends
I opened my Minecraft server to five friends with the default port and no whitelist, then watched port scans arrive. Here is what moving the port changed, what the whitelist actually controlled, and why an SRV record kept joining simple.
OriginsHow the lab began2 min read
How a Minecraft server for my friends grew into a lab
The lab exists because I wanted somewhere to run a Minecraft server for friends. One container turned into Proxmox, Sophos, private access, Active Directory and a place for my thesis. This is how one question led to the next.
Active DirectoryThe Active Directory lab7 min read
Managing accounts, OUs and Group Policy in my AD lab
Why I put my Windows machines in a domain, what that let me control, and how I used accounts, OUs, Group Policy and audit events to manage and troubleshoot endpoints.
Network operationsGrowing the infrastructure3 min read
Reading my Sophos threat-feed snapshot
On 6 November 2026 my Sophos active threat response page showed 20 of 30 feeds active and 94% of the feed quota used. I split what that one screen says into configuration, download health, enforcement and overlap, because each needs different evidence.
Network operationsGrowing the infrastructure5 min read
Tracing a DNS failure: why the firewall answered NXDOMAIN
A container could not install updates. I traced the failure through Proxmox, Sophos and my NextDNS forwarder, found the gateway answering NXDOMAIN on its own, and wrote it up the way I would for a ticket.
Active DirectoryThe Active Directory lab4 min read
Tracing a failed domain sign-in
Once I had Windows machines to look after, Active Directory became one of the tools I used most. This is how I read the evidence a single logon leaves behind, and which questions it can and cannot answer.
GRCPrivate access and GRC2 min read
Turning a written control into a check I can run
I demonstrated GRC policies in the lab by giving them something I could check. Shell and Python turned each control into a repeatable test with an expected state, an observed state, and a follow-up.
DNSGrowing the infrastructure3 min read
What my DNS logs can and cannot tell me
NextDNS gives the lab a resolver with a policy and a log of every query. I keep that log private because it reveals what my devices do, so this entry reads a simulated day honestly instead.
DetectionDetection and response notes5 min read
Working a simulated SOC case with a bounded AI step
How I use AI agents to speed up the tedious parts of SOAR work, gathering, normalising, grouping and drafting, and where the playbook stops them so a person makes the call. Walked through on a simulated case.