hMailServer Alert Test
Testing my own hMailServer failed-login detection: eleven failed logins from a Thunderbird client raise Wazuh rules 100321 and 100322, open a LabWatch incident, and get triaged step by step.
Homelab environment
3 physical hosts · 8 VMsI built an Active Directory lab with two Windows 11 endpoints, a shared application server, Wazuh detection, Elasticsearch/Kibana analysis, a Kali workstation, and a Suricata/Zeek network sensor. SRV01 combines deliberately vulnerable web practice with protected document and incident-management services. I use the lab to investigate alerts, test detections, troubleshoot failures, and document recovery.
LABHV
Enterprise
Windows 11 Host · VMware Workstation
BLUETEAM
Detection
Windows 11 Host · VMware Workstation
ATTACKBOX
Adversary
Windows 11 Host · VMware Workstation
| VM | Role | Platform | Core technologies |
|---|---|---|---|
| DC01 | Identity and directory | Windows Server 2022 | AD DS · DNS · Kerberos · lab certificate authority |
| SRV01 | Applications and practice range | Windows Server 2022 | IIS/PHP · MySQL · hMailServer · Corp Documents · LabWatch · DVWA · BountyAPI |
| WS01 / WS02 | Instrumented endpoints | Windows 11 | Sysmon · Wazuh · Velociraptor |
| SIEM01 | Detection and DFIR | Ubuntu 26.04 | Wazuh · Velociraptor · Elastic alert forwarder |
| SIEM02 | Analytics and decision layer | Ubuntu 26.04 | Elasticsearch · Kibana · Wazuh and network analysis |
| KALI | Adversary emulation | Kali Linux | Nmap · Impacket · NetExec · BloodHound |
| NDR01 | Passive network sensor | Ubuntu 26.04 | Suricata · Zeek · mirrored switch traffic |
Latest
2026-092026-09-30T1110.001~8 min
2026-09-11DFIR~6 min
Roll the Dice: INC-2026-0038
The first round of a homelab exercise: Claude Code injects a real fault and files a ticket, and I work it blind as a live incident. One workstation cannot reach an internal web app while every other host and port is fine. The cause is a single outbound firewall rule, found by listing rules on what I knew instead of a guessed name and pinned to its port and address by a shared InstanceId.
2026-09-08Homelab~47 min
Homelab Walkthrough
A September snapshot of my SOC homelab, from physical hosts and Active Directory to Wazuh, Velociraptor, the former Splunk and C2 roles, and LabWatch incident response.
2026-09-02T1558~18 min
AS-REP+Kerberoasting 1
AS-REP roasting and AES Kerberoasting captured from KALI, traced through DC01 events, detected in Wazuh, inspected in Wireshark, and tested with offline cracking.
2026-08-16T1219~15 min
One RMM Is IT. Two Is An Incident.
One remote-access tool on a machine is normal; every managed service provider has one. The useful question is whether a second one showed up and whether the first one put it there. Four Wazuh rules built and fired against a live workstation, and the vendor-list gap that made the rule miss a real campaign.
2026-08-02DFIR~6 min
Installing Velociraptor in My Homelab
The service came up on the first try, then I deleted it and rebuilt it because I could not have said what half of it was doing. Two version-pinned traps, including a config generator offering to write private keys onto a network share.