A free list to start the lab. A paid extension (when it exists) is a separate product — nothing is charged here.
1. Host
- a machine you are allowed to put VMs on
- enough RAM/disk for two endpoints + a collector
- lab network kept away from things you must not break
- note: hypervisor, version, date
2. Endpoints
- Windows (lab, not a work laptop)
- Linux
- time in sync
- hostnames you can recognise in a log
3. Logs before SIEM
- Windows: Security + PowerShell (see docs)
- Linux: journal / auth
- you know where the file or channel is locally
4. Collector
- Wazuh manager in the lab or a conscious “not yet”
- agent on each endpoint or equivalent shipping
- one test event visible on the collector
5. L1 exercise
- a generated event (logon, process — your own)
- note: true / false / escalate
- one sentence on “what the log does not show”
Do not tick ATT&CK if you have no event you can actually attach to a technique.