Building a home lab and a portfolio

Why a lab beats another certificate

In interviews, "I set up Sysmon and Wazuh, simulated a brute-force attack on my own Windows VM, and here is the alert and my write-up" is far stronger than "I watched videos about SIEMs". A lab also makes everything in this course real: you see Event 4625 appear because you caused it.

What you need

• A computer with at least 16 GB of RAM if possible (8 GB works for a very small lab), a modern CPU with virtualisation turned on in the BIOS/UEFI, and 100 GB or more of free disk space.
• A hypervisor (software that runs virtual machines): Oracle VirtualBox or VMware Workstation Pro (free for personal use).
• Operating systems: Ubuntu Server or Desktop (free), and a Windows evaluation edition from Microsoft's Evaluation Center (time-limited, free for testing).

A starter blue-team lab

Put the VMs on a host-only or internal network, so they can talk to each other but not to your home network or the internet (allow internet only when installing updates). Take snapshots (saved states) so you can roll back after experiments.

$ VBoxManage list vms
"siem-wazuh" {3f6c...}
"win-victim" {9a12...}
"attacker" {b77e...}
$ VBoxManage snapshot "win-victim" take "clean-before-test"

Lab exercises that map to jobs

1. Brute force: from the attacker VM, try wrong passwords against the Windows VM (RDP or SMB) and find the 4625 events and the SIEM alert. Then turn on account lockout and see 4740.
2. Persistence: create a scheduled task on the Windows VM yourself, and find it in Sysmon and Security logs (4698).
3. Phishing analysis: analyse sample phishing emails from legal practice platforms; extract headers and IOCs.
4. Detection: write a Sigma rule for one behaviour, convert it, and test it.
5. Python: write a script that parses exported logs and prints a summary.

Building a portfolio

• A GitHub profile with: your Python scripts from this course, Sigma rules, lab setup notes.
• Write-ups: one page per investigation: scenario, evidence, timeline, verdict, what you would improve. Use made-up or provided data only, never real company data.
• A short blog or LinkedIn posts explaining what you learned in plain words.
• Completion badges from practice platforms, listed honestly as practice, not as jobs.

Common mistakes

• Bridged networking, putting a deliberately weak VM on your home Wi-Fi.
• Spending weeks on lab hardware and never writing up results.
• Copying other people's write-ups. Interviewers ask follow-up questions.
• Publishing screenshots that contain your real IP address, passwords or employer data.