How to Build a Blue Team Home Lab: A Step-by-Step Architecture Guide

How to Build a Blue Team Home Lab: A Step-by-Step Architecture Guide

A home lab can help you practice collecting logs, testing a detection query and explaining what the evidence does and does not show. It does not guarantee interviews, employment or production readiness. Document only work you actually completed.

This is a planning guide, not a tested end-to-end walkthrough. The Microsoft Sysmon example below was reviewed against documentation, not executed in a live Windows lab. The Splunk installation module is unavailable pending source verification and is excluded from this release.

1. Authorization and Network Boundaries

Use systems and data you own or are explicitly authorized to administer. Keep this exercise to benign local log generation; it does not require malware, an external target or a live attack service.

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030 is not a blanket “safe harbor” for a lab. This guide's written-authorization and isolation rules are operational constraints, not a claim that every scan is criminal or that permission settles every legal issue. Applicable law and contracts depend on the circumstances.

Network modes are not interchangeable

Use an Internal Network for the simulation segment when no host or external connectivity is needed. In VirtualBox, host-only networking includes communication with the host; NAT/NAT Network normally allows outbound connectivity, which can include networks you did not intend to test. Neither mode is a guarantee of complete isolation from a home LAN.

If you temporarily attach a NAT adapter for updates, detach it before exercises and verify the remaining adapters and routes. Do not use bridged networking for this beginner simulation. Check the VirtualBox network-mode documentation for the actual behavior of your version. A VM snapshot is a recovery aid, not a security boundary.

2. Example Four-VM Topology and Sizing

Use a private subnet for a domain controller, Windows client, optional Linux analysis VM and SIEM VM. For example, reserve 192.168.56.20 for the DC, .30 for the client and .50 for the SIEM; avoid conflicts with any real network you use.

A guest allocation of 2 + 4 + 4 + 4 GB totals 14 GB before the host and hypervisor. Do not assume a 16 GB laptop can comfortably run this entire topology. Run fewer VMs or size the host against current vendor requirements and actual measurements. Resource allocations here are planning examples, not verified minimums.

Obtain operating-system images from the vendors. Evaluation media have product-specific time limits, terms and activation requirements. Read those terms before installation; do not assume a universal duration or a right to repeatedly rearm an expired evaluation.

3. Provisioning and Audit Policy

Install supported hypervisor and guest versions. Create an internal network, assign non-conflicting addresses and set the Windows client's DNS to the lab DC when using AD DS. Take a clean snapshot after updating and configuring the guests, then remove temporary external connectivity.

In the lab domain, review Advanced Audit Policy settings for logon and process creation, and the separate setting that includes command lines in process-creation events. Verify actual events rather than assuming defaults. Security events 4624/4625 and 4688 are useful examples, but generated fields depend on configuration and logon type.

4. Documentation-Reviewed Local Sysmon Exercise

Microsoft Sysmon records events according to its configuration. The community SwiftOnSecurity configuration is not Microsoft’s official configuration or a guarantee that all desired events are enabled. Review its filters and hashing settings before installation.

An illustrative installation command, after reviewing the downloaded configuration:

.\Sysmon64.exe -accepteula -i sysmon-config.xml

Check the Microsoft-Windows-Sysmon/Operational log and confirm that process-creation events are enabled. Other event types, including network connection events, depend on the selected configuration.

Prerequisites and validation status

Use a Windows system supported by the current Microsoft Sysmon documentation, administrator rights, an authorized local machine and a reviewed configuration that records process creation. Check the applicable operating-system and Sysmon terms. Allow space for logs and keep personal or confidential command-line data private.

The installation syntax and event-channel description were checked against Microsoft documentation on October 19, 2026. No Windows VM was run for this review. Your event output, configuration filters and recovery process must be validated on your own authorized system.

Splunk installation module — unavailable

Splunk receiver/forwarder installation, configuration examples, SPL searches and licensing instructions are withheld from this release. The official documentation could not be independently retrieved, and no end-to-end Splunk walkthrough was performed. This guide provides no trial allowance, free-license entitlement or verified Splunk setup procedure. Do not infer installation readiness from the optional SIEM VM in the planning diagram.

5. Benign Encoded PowerShell Log Generation

Only on your authorized lab client, use this local message to test process telemetry. It decodes to Write-Output 'Cyber Compass lab test'; it does not download anything or contact a domain.

powershell.exe -NoProfile -NonInteractive -EncodedCommand VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAEMAeQBiAGUAcgAgAEMAbwBtAHAAYQBzAHMAIABsAGEAYgAgAHQAZQBzAHQAJwA=

Open Event Viewer → Applications and Services Logs → Microsoft → Windows → Sysmon → Operational. Look for a process-creation event (Event ID 1) near the command's timestamp and inspect the actual image and command-line fields. This local inspection does not require a SIEM or a forwarder.

If no matching event appears: confirm Sysmon is installed/running, you opened the Operational channel, process creation is enabled and the reviewed configuration does not exclude the test. Check permissions and the recorded timestamp. Do not change production policy or disable security tools to make an event appear. If the prerequisites are not met, record that limitation instead of claiming successful detection.

Encoded PowerShell is not itself proof of malicious activity. Confirm the decoded command, parent process and context. This is a documentation-reviewed exercise, not observed execution evidence or a tested alert.

6. Recovery and Honest Portfolio Evidence

Record snapshot names, guest versions and actual recovery steps; do not promise a fixed restoration time. When evaluation rights expire, follow the vendor's terms instead of assuming a universal extension command.

Before sharing a report, remove credentials, personal data and confidential artifacts. Explain your architecture, the event generated, query results, failed attempts and limitations. Do not present simulated activity as employment experience.

Next Steps

• Home-lab blueprint and checklist — use it as a planning aid, not a certification of legal or network safety.
• CompTIA CySA+ and GIAC GSOC — check issuer requirements through the catalog. CompTIA lists CS0-004 (v4) as launched June 23, 2026; the v3 page gives an estimated 2026 retirement rather than a specific date. Confirm the bookable version and local price before paying; see the current v4 page (checked October 19, 2026).
• Interview questions and Career Finder — practice explaining the evidence you actually collected.

Source review

Microsoft Sysmon documentation was checked October 19, 2026. Hypervisor behavior requires the linked current vendor documentation for the installed versions. The unverified Splunk installation appendix is not included. The CFAA citation is a statute reference, not a claimed legal review or safe-harbor opinion.