umidguluzada/cyberdefense-labA complete Blue Team Cybersecurity Lab featuring pfSense, Suricata, and ELK Stack for network monitoring and threat detection.
This laboratory project demonstrates the creation of an integrated "Blue Team" infrastructure, focusing on centralized network security, Intrusion Detection/Prevention Systems (IDS/IPS), and Security Information and Event Management (SIEM) using pfSense.
The laboratory environment is designed in a virtualized setting (VMware) using network segmentation principles:
To ensure security, the attacker and victim machines are placed in separate subnets:
| Device / Interface | IP Address / Network | Purpose |
|---|
| pfSense WAN | 192.168.1.69/24 | External traffic interface |
| pfSense LAN1 (LAN) | 192.168.10.1/24 | Internal secure network |
| pfSense OPT1 (ATTACK) | 192.168.20.1/24 | Isolated attack network |
| Ubuntu Server (ELK) | 192.168.10.55 | SIEM monitoring center |
| Windows (Victim) | 192.168.10.50 | Target system in the internal network |
| Kali Linux (Attacker) | 192.168.20.50 | Simulated external attacker |
Inline IPS (netmap) mode to block threats. For stability, the VM adapter type was set to E1000 with Promiscuous mode enabled.emerging-exploit, emerging-scan, and emerging-malware rule sets.192.168.20.50) is automatically added to the "Block Offenders" list.Remote Syslog to the server at 192.168.10.55 on port 5140. Suricata logs are exported in EVE JSON format and ingested into ELK via Filebeat.Key challenges and implemented solutions during the lab setup include:
OPT1).Event ID 4625 logs were generated.nmap -sS scans from Kali Linux were instantly detected by pfSense, and the attacker's IP was successfully blocked.Hydra and Suricata alerts were successfully monitored in real-time via the Kibana dashboard.Note: This project is a complete cybersecurity laboratory environment built strictly for educational and practical purposes.