Labs · v22
Labs
Follow the Progressive Labs in sequence, then use the Supplemental Labs to practice specific forensic skills with their companion field guides.
View chapter and lab alignment
Progressive Labs
PL-00Progressive labProgressive Lab PL-00 — Wazuh & Suricata: Initial Lab Testing and ValidationAlerts to Answers Progressive Lab PL-00 — Wazuh & Suricata: Initial Lab Testing and Validation Introduction Objective Validate that every component of your Enterprise Security…ResourcesReset WIN11Reset UB2604Reset WAZUH-SRVOpen →PL-0AProgressive labProgressive Lab PL-00A — EICAR, YARA, Microsoft Defender, and Wazuh ValidationLab 0A — EICAR, YARA, Microsoft Defender, and Wazuh Validation — v20 Chapter and Lab Alignment Alignment Placement Primary lab alignment Lab 0 — Operational Health Validation…ResourcesCreate EICAR test fileReview Defender eventsEICAR YARA ruleOpen →PL-01Progressive labProgressive Lab PL-01 — SIEM Familiarization & Your First DetectionAlerts to Answers Progressive Lab PL-01 — SIEM Familiarization & Your First Detection This is the most heavily guided lab in the book. Every command is explained line by line,…No separate student script requiredOpen →PL-02Progressive labProgressive Lab PL-02 — SIEM Configuration & Attack AnalysisAlerts to Answers Progressive Lab PL-02 — SIEM Configuration & Attack Analysis Lab 1 taught you to find an attack. This lab teaches you to investigate one. It is designed not to…No separate student script requiredOpen →PL-03Progressive labProgressive Lab PL-03 — SIEM Analyst Use-Case WalkthroughAlerts to Answers Progressive Lab PL-03 — SIEM Analyst Use-Case Walkthrough This lab walks the complete threat lifecycle end to end on a scenario you generate yourself: collect →…No separate student script requiredOpen →PL-04Progressive labProgressive Lab PL-04 — SIEM Ransomware InvestigationAlerts to Answers Progressive Lab PL-04 — SIEM Ransomware Investigation Ransomware is fast, loud, and unforgiving — which makes it a perfect teacher. In this lab you configure…No separate student script requiredOpen →PL-05Progressive labProgressive Lab PL-05 — Sysmon Investigation: Reconstructing an Attack from Endpoint TelemetryAlerts to Answers Progressive Lab PL-05 — Sysmon Investigation: Reconstructing an Attack from Endpoint Telemetry Introduction Objective Reconstruct a complete attack chain on…ResourcesGenerate Sysmon investigationOpen →PL-06Progressive labProgressive Lab PL-06 — Emerging Threats Investigation: Hunting an Attack Across the NetworkAlerts to Answers Lab 6 — Emerging Threats Investigation: Hunting an Attack Across the Network Introduction Objective Reconstruct a multi-stage network attack using Suricata and…ResourcesGenerate attack telemetryGenerate beacon trafficOpen →PL-07Progressive labProgressive Lab PL-07 — Threat Intelligence Investigation: Enriching Indicators and Operationalizing IntelAlerts to Answers Progressive Lab PL-07 — Threat Intelligence Investigation: Enriching Indicators and Operationalizing Intel Introduction Objective Take a set of raw indicators…ResourcesIOC enrichment datasetOpen →PL-08Progressive labProgressive Lab PL-08 — Capstone: File Integrity Monitoring, Active Response, and Correlated InvestigationAlerts to Answers Progressive Lab PL-08 — Capstone: File Integrity Monitoring, Active Response, and Correlated Investigation Introduction Objective Complete the analyst arc from…ResourcesGenerate FIM change burstOpen →PL-09Progressive labProgressive Lab PL-09 — Diagnostic ChallengeLab 9 — Diagnostic Challenge Estimated time: 90 minutes Machines used: WAZUH-SRV, UB2604, WIN11 Prerequisites: Labs 0 through 8 complete; environment previously validated Purpose…ResourcesShared reset toolsOpen →Supplemental Labs
Focused exercises paired with field guides. Complete them when their prerequisites are met; the Progressive Lab sequence is unchanged.
