An Active Directory purple-team lab that fights back — and records everything. Four VMs via Vagrant and Ansible: Windows Server 2022 domain, Vector telemetry, Graylog detection. Run the attack, read the logs, write the rule, watch it fire, then evade it.
ansible vagrant vmware graylog vector active-directory sysmon siem sigma homelab red-team security-automation blue-team mitre-attack threat-detection purple-team windows-event-log security-lab badblood window-event-log
-
Updated
Oct 16, 2026 - PowerShell