Achilles Rogan

Project

Isolated Attack/Defend (Purple Team) Lab

In progress
This page describes planned and underway work. It has no results, alert data, or findings yet, and it will be updated as the lab is built.

Overview

I am building a purple team lab where I play both sides. A Kali attacker machine runs simulated attacks against a deliberately weak target on an isolated network. On the defensive side, a SIEM raises live alerts, and I triage them with AI assistance under my own review.

Goals

  • Run attacks mapped to MITRE ATT&CK and confirm what the defensive side does and does not see
  • Practice alert triage under realistic conditions, from first alert to written conclusion
  • Test how AI-assisted triage can speed up analysis while a human makes the final call
  • Find detection gaps and close them with new or tuned rules

Planned approach

  • Isolation: attacker and target sit on an isolated lab network with no route to my home network or the internet. The weak target is never exposed outside the lab
  • Attacker: Kali Linux for manual techniques, plus Atomic Red Team for repeatable, ATT&CK-mapped tests
  • Target: an intentionally misconfigured system, rebuilt from snapshots so every test starts from a known state
  • Defense: the target's logs go to a SIEM, and each simulated technique is checked for whether it produced an alert
  • Triage: AI-assisted summaries and enrichment of alerts. I review every conclusion and document what the assistant got right or wrong
  • Feedback loop: every missed technique becomes a detection task, which then gets re-tested

What it will demonstrate

  • Understanding of attacker techniques through the ATT&CK framework, from both sides
  • Hands-on SIEM alerting and triage, the core of SOC analyst work
  • Detection engineering driven by tested coverage gaps
  • Responsible use of AI in security operations, with a human in the loop

Status and roadmap

  • Now: planning the isolated network and the set of target weaknesses
  • Next: build the attacker and target, verify isolation, and connect the target to the SIEM
  • Then: run a first set of ATT&CK-mapped simulations and triage the resulting alerts
  • Later (planned): this lab is a step toward an internet-facing honeypot. That will be designed separately, with its own isolation and safety review, before anything is exposed

Related: Home SOC lab and Detection rules.