Every article on this site is tested here. When an article says “Tested in Range v1.0”, this is the lab it means.
The lab changes over time. When it does, the version number goes up and the change is listed at the bottom of this page.
The Rooms
The lab is split into separate networks, like rooms in a building with a guard at every door. The guard is the firewall.
| Room | What it is | Who can it talk to? |
|---|---|---|
| Corp | A small pretend company: a domain controller and an employee PC | The firewall, the SIEM, and the internet (unless the kill switch is on) |
| SOC | The security team’s room, where all the logs end up | The rooms it watches |
| Red | The attacker’s machine | Only the SIEM, to send its own logs. Everything else can be switched off. |
| Malware room | For studying malware | Nothing. It has no network cable at all. |
| Personal network | My own laptop and devices | No lab room can reach it. Blocked at the firewall. |
Note
The rooms cannot see each other’s traffic directly. Everything between rooms goes through the firewall. Traffic inside one room does not. That is a blind spot, and there is an article about it.
The Machines
| Machine | Room | What it is |
|---|---|---|
| DC01 | Corp | Windows Server 2025, the domain controller (it manages logins for the whole company) |
| WS01 | Corp | Windows 10, a normal employee PC |
| SIEM | SOC | Ubuntu with Splunk Enterprise 10.4 (free developer licence) |
| Analyst workstation | SOC | Kali Purple, for investigating |
| Kali | Red | Kali Linux 2026.2, the attacker |
| Firewall | Middle | OPNsense, which routes and filters between rooms |
What Gets Recorded
| Source | Where | What it records |
|---|---|---|
| Sysmon | Windows | Programs starting, network connections, file changes, and more |
| Windows Security log | Windows | Logins, new processes with their full command line (4688) |
| PowerShell log | Windows | The actual script text that PowerShell ran (4104) |
| auditd | Linux | Every command run on the attacker machine |
| Firewall log | Firewall | Connections between rooms that were allowed or blocked |
| DNS log | Firewall | Every website name a lab machine looked up |
The Safety Switches
Some tests are risky, so the lab has switches that can be flipped before running them.
- Corp internet kill switch. Cuts the company network off from the internet, so a test cannot contact the outside world.
- Red isolation switch. Cuts the attacker machine off from everything except sending its logs.
- Snapshots. Every machine is saved in a clean state, and goes back to it after every test.
Changelog
| Version | Date | What changed |
|---|---|---|
| v1.0 | 10 Oct 2026 | First version: Corp, SOC, Red and malware rooms, Splunk, Sysmon, auditd, firewall and DNS logs |