Detection is harder than intrusion

Offensive security has excellent marketing. Exploits are cinematic; dashboards are not. So when I designed my virtual security lab, I made a rule that shaped everything after it: the monitoring stack gets deployed before the first exploit is run. Wazuh and Zabbix went in on day one. Metasploit waited.

Two subnets, one honest boundary

The lab is split into attacker and defender subnetworks separated by MikroTik routing. That boundary is the point. An attack that has to cross a real routed edge behaves like an attack in production — it takes the same path, touches the same controls, and leaves the same traces. Flat-network labs skip the part that matters.

The noise problem

Here is what the marketing never mentions: a default SIEM sees everything and tells you nothing. My first Metasploit runs surfaced in Wazuh — buried in hundreds of alerts that meant nothing. Tuning detection rules to catch real attack behavior without drowning in noise took longer than every exploit combined. It is also, I now believe, the most employable skill the lab taught me.

Defense changes how you attack

Once you've sat on the defender's side watching your own intrusion surface in the logs, you attack differently — and you build differently. Every system I've deployed since, from web platforms to Linux infrastructure, gets designed with one question in the room: what would this look like in the SIEM when someone comes for it? Offense-informed defense isn't a slogan; it's a feedback loop, and running both sides of it on my own infrastructure closed the loop for good.