Status
ISOLATED LAB
Phase
03_INITIAL_ACCESS
Egress
BLOCKED
?
Create Snapshot
Resume Session
APPRENTICESHIP // W6
Monitoring & Detection Pipeline
Stand up the blue-team side: log forwarding, dashboards, alert rules.
Set Current
Objectives
01
Install Elastic + Kibana on LINUX01, ingest Winlogbeat from DC01 and WIN01.
02
Build dashboards for authentication, process creation, and share access.
03
Write three detection rules keyed to lab-only ATT&CK techniques.
Hosts in play
DC01.LAB
WIN01.LAB
LINUX01
Checklist
Winlogbeat forwarding from DC01, WIN01, FS01.
Kibana dashboard 'Auth Overview' saved.
Detection rules: T1110 spray, T1059.001 encoded PowerShell, T1003 LSASS access.
Snapshot: blue-baseline.