Enterprise Security Lab
A multi-OS virtual security lab with MikroTik routing, Wazuh and Zabbix monitoring, and Metasploit for penetration testing across two subnetworks.
CybersecurityContext
Real attack-and-defense skills can't be learned from slides. They need production-like infrastructure that is safe to break.
The problem
Security skills learned from slides don't survive contact with a real network. Practicing attack and defense requires infrastructure that behaves like production — routed, monitored, multi-OS — while staying safe to break. Public labs give you targets; they don't teach you to run the defense.
Decisions
Two subnets, one MikroTik boundary
Attacker and defender networks were separated by MikroTik routing, so every attack had to cross a real network boundary — the same path it would take in production, visible to the same controls.
Detection as a first-class citizen
Wazuh (SIEM) and Zabbix (monitoring) were deployed before the first exploit was run. The point was never just to get in — it was to watch what getting in looks like from the defender's chair.
Multi-OS on purpose
Kali for offense, mixed targets for defense — because real environments are heterogeneous, and detection rules that only work on one OS are a false sense of security.
Challenges
Tuning was the real work: detection rules that catch Metasploit activity without drowning in alert noise, and squeezing an entire monitored enterprise onto one host's worth of virtual machines without the lab collapsing under its own resource use.
Result
A complete attack-and-defense loop on my own infrastructure: launch an intrusion on one subnet, watch it surface in the SIEM on the other, and trace the kill chain end to end.
Lesson
Detection is harder than intrusion. Building the defensive side taught me more than any exploit did.
Next case
047-Server Linux Infrastructure