What is cyberdefense-lab?

CyberDefense Lab is a documented blueprint for building a home cybersecurity practice lab rather than a piece of software you run. It walks through setting up a small virtualized network using VMware, with a pfSense firewall, an Ubuntu server running the ELK stack for monitoring, a Windows machine acting as a target, and a Kali Linux machine acting as a simulated attacker. Each virtual machine gets its own IP range, and the attacker and target are kept on separate network segments so all traffic between them has to pass through the firewall, where it can be inspected and logged. The core defensive piece is Suricata, an intrusion detection and prevention tool, configured here in an inline mode that can actively block traffic rather than just watching it. It uses rule sets designed to catch exploits, scans, and malware, plus a custom rule that flags and blocks an IP automatically if it sends more than 20 connection attempts in 10 seconds, catching typical network scanning behavior. Logs from the firewall and from Suricata are forwarded into the ELK stack (Elasticsearch, Logstash, and Kibana) so an operator can search and visualize security events, including failed Windows login attempts. The README also documents real problems the author ran into while building this, such as attacks not showing up because two machines were mistakenly on the same network segment, and the ELK server crashing until more memory was allocated to it. It finishes with verification steps showing that a simulated network scan was detected and blocked, and that brute-force login attempts were visible in the Kibana dashboard in real time. This project is explicitly built for education and practice, not production use. It suits someone learning blue team security concepts, network segmentation, or SIEM tooling who wants a concrete, working reference lab to replicate rather than an installable application.