Test Environment Builder

Build an adversary emulation lab for Splunk using this skill to configure Attack Range with Terraform and Docker Compose. It provides step-by-step workflows to deploy Windows servers, install Sysmon, and configure Splunk forwarders for security detection testing.

Yes, you can configure Elastic Security and Microsoft Sentinel lab environments. This SIEM-agnostic skill supports multiple platforms, mapping required data sources to infrastructure components and guiding deployment for comprehensive security testing.

Map data sources to infrastructure for detection engineering using this skill to identify required log sources and configure the corresponding components. It provides guidance for setting up Windows, Linux, network sensors, and cloud resources to generate specific telemetry.

Automate deployment of a SIEM testing environment using this skill for step-by-step guidance with Terraform, Ansible, and Docker Compose. It facilitates configuring and deploying lab infrastructure across multiple SIEM platforms to ensure realistic telemetry generation.

Yes, this skill works with generic Docker setups for security testing. It supports configuring lab environments using Docker Compose alongside specific SIEM platforms like Splunk, Elastic Security, and Microsoft Sentinel for adversary emulation.

Test a Splunk detection rule relying on Sysmon process creation events by using this skill to configure Attack Range with a Windows server. It guides you through installing Sysmon and deploying the necessary Splunk forwarder to generate the required telemetry.