Tools and documentation
Every tool that appears in a published entry, what it does in my lab, and a link to its official documentation. The label says whether it runs in my lab, whether I use it without a recorded host, whether it is a reference I read but do not run, or whether it builds this site. Links go to the vendor's or project's own site and open in the same tab.
Infrastructure
What the lab and this site run on.
Proxmox VE
The hypervisor on my laptop: bridges, VMs, LXC containers and snapshots.
In my labOfficial documentation for Proxmox VE pve.proxmox.com
Proxmox containers (LXC)
Most lab services, and this site, run as unprivileged containers.
In my labOfficial documentation for Proxmox containers (LXC) pve.proxmox.com
Ubuntu Server
The operating system of CT 410, which serves this site.
In my labOfficial documentation for Ubuntu Server documentation.ubuntu.com
Crafty Controller
Runs and manages the Minecraft server in LXC 207.
In my labOfficial documentation for Crafty Controller docs.craftycontrol.com
Minecraft Java Edition server
The Minecraft server for five friends that started the lab.
In my labOfficial documentation for Minecraft Java Edition server www.minecraft.net
Network and access
How traffic gets in, out and between segments.
Sophos Firewall
Gateway, VLANs, firewall rules, IPS and threat feeds for the lab.
In my labOfficial documentation for Sophos Firewall docs.sophos.com
Cloudflare DNS
Holds the records, including the SRV record that gives friends one name for the Minecraft server.
In my labOfficial documentation for Cloudflare DNS developers.cloudflare.com
Cloudflare Tunnel
Carries portfolio HTTP traffic from Cloudflare to Caddy without an open WAN port.
In my labOfficial documentation for Cloudflare Tunnel developers.cloudflare.com
Cloudflare WAF
Filters requests to this site before they reach the tunnel; the site is read-only, so writes are refused.
In my labOfficial documentation for Cloudflare WAF developers.cloudflare.com
Cloudflare Workers
Would run the optional visitor-panel endpoint at the edge, separate from the site.
External referenceOfficial documentation for Cloudflare Workers developers.cloudflare.com
Caddy
Serves this site on loopback inside CT 410 with its security headers; the public origin, not a LAN proxy.
BunkerWeb
My private reverse proxy on the LAN, separate from Caddy’s public role. I have not verified its routes.
In my labOfficial documentation for BunkerWeb docs.bunkerweb.io
SafeLine
A web application firewall container, tagged VLAN 20 and used for the LAB_TEST checks.
In my labOfficial documentation for SafeLine docs.waf.chaitin.com
NextDNS
The DNS-over-HTTPS resolver behind my forwarder, with query logs per client.
WireGuard
The tunnel from the public VPS to the Minecraft server, around carrier-grade NAT.
In my labOfficial documentation for WireGuard www.wireguard.com
Twingate
User-based access to named Resources through an outbound connector.
In my labOfficial documentation for Twingate www.twingate.com
NetBird
Device-based access between peer groups, with a routing peer into the LAN.
Identity and endpoints
Accounts, policy and what Windows records.
Active Directory Domain Services
Accounts, groups and OUs for the Windows lab.
I use itOfficial documentation for Active Directory Domain Services learn.microsoft.com
Group Policy
Password, lockout, audit and sign-in policy, scoped by OU.
I use itOfficial documentation for Group Policy learn.microsoft.com
Windows security auditing
Decides which logon and account events the Security log records.
I use itOfficial documentation for Windows security auditing learn.microsoft.com
Network Policy Server (802.1X)
The RADIUS server in my Wi-Fi design; designed, not deployed.
External referenceOfficial documentation for Network Policy Server (802.1X) learn.microsoft.com
PowerShell
Read-only queries against AD and the Security log.
I use itOfficial documentation for PowerShell learn.microsoft.com
Sysmon
Process and network events the Security log does not carry; part of the reference stack.
External referenceOfficial documentation for Sysmon learn.microsoft.com
Microsoft Defender for Endpoint
An endpoint sensor and portal I explored on a trial, beside Splunk.
I use itOfficial documentation for Microsoft Defender for Endpoint learn.microsoft.com
Microsoft Defender XDR
Where Defender incidents are correlated; a reference for the SIEM integration.
External referenceOfficial documentation for Microsoft Defender XDR learn.microsoft.com
SOC, testing and automation
Detection, investigation and the attack lab.
Wazuh
Agents, manager and indexer: the detection layer of the SOCFortress stack.
External referenceOfficial documentation for Wazuh documentation.wazuh.com
SOCFortress CoPilot
The SOC workspace for alerts and cases over the rest of the stack.
External referenceOfficial documentation for SOCFortress CoPilot docs.socfortress.co
Graylog
Parses Sophos syslog into fields before CoPilot sees it.
External referenceOfficial documentation for Graylog go2docs.graylog.org
Velociraptor
Endpoint forensics the stack calls from a case.
External referenceOfficial documentation for Velociraptor docs.velociraptor.app
Shuffle
SOAR playbooks; my design keeps an approval step before any action.
External referenceOfficial documentation for Shuffle github.com
Grafana
Dashboards in the reference stack.
External referenceOfficial documentation for Grafana grafana.com
InfluxDB
Time-series store behind those dashboards.
External referenceOfficial documentation for InfluxDB docs.influxdata.com
OpenCTI
Threat-intelligence platform named in the reference stack.
External referenceOfficial documentation for OpenCTI docs.opencti.io
Splunk Enterprise
A second SIEM view of the same endpoints, queried with SPL.
I use itOfficial documentation for Splunk Enterprise help.splunk.com
Kali Linux
Kali Red runs scoped tests and Kali Blue collects evidence, inside LAB_TEST.
Burp Suite
An intercepting proxy for the lab web app walkthrough.
In my labOfficial documentation for Burp Suite portswigger.net
Metasploit Framework
Banner checks only, followed by a snapshot restore.
In my labOfficial documentation for Metasploit Framework docs.metasploit.com
Wireshark
Reading captures from the Blue side.
In my labOfficial documentation for Wireshark www.wireshark.org
tcpdump
Capturing on the lab interface while a test runs.
BloodHound
Graphs AD relationships; I read its output, it is not running in my inventory.
External referenceOfficial documentation for BloodHound bloodhound.specterops.io
Development
How this journal and its scripts are built.
Astro
Builds this journal as static pages.
Builds this siteOfficial documentation for Astro docs.astro.build
MDX
Lets an entry use the site’s figures and diagrams.
Builds this siteOfficial documentation for MDX mdxjs.com
TypeScript
The data files and browser scripts.
Builds this siteOfficial documentation for TypeScript www.typescriptlang.org
Node.js
Runs the build and the unit tests.
Builds this siteOfficial documentation for Node.js nodejs.org
Playwright
Drives the browser checks for collisions, motion and keyboard use.
Builds this siteOfficial documentation for Playwright playwright.dev
Bash
The release, activate, rollback and smoke-test scripts.
Builds this siteOfficial documentation for Bash www.gnu.org
Python
The baseline comparison script in the control-check entry.
Git
Every release is named after the commit it was built from.
Builds this siteOfficial documentation for Git git-scm.com
Product names and logos belong to their owners and appear only to name the tools I use. Where no permitted logo was available, a named line icon stands in. Icon sources and licences are listed inpublic/icons/icons-credits.json in the site's source.