clong/DetectionLab resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

5010 stars · 1010 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

DetectionLab is an automation project that builds a Windows domain lab environment pre-loaded with security tooling and logging best practices using Vagrant, Packer, Terraform, and Ansible. It is designed for defenders to quickly spin up hosts with tools like Splunk, osquery/Fleet, Sysmon, Zeek, and Suricata for detection and DFIR testing.

Use cases

• build a windows domain lab for security testing
• set up a dfir lab environment
• practice security detection engineering
• test sysmon and osquery configurations
• learn windows event forwarding and logging best practices
• simulate an enterprise network for blue team training

When to choose

• you need a reproducible windows domain lab with pre-installed security tooling
• you want to learn or test detection and logging configurations
• you are a defender or DFIR analyst practicing in a safe environment

When to avoid

• you need a hardened or production-ready environment
• you require active maintenance or up-to-date tooling
• you want a minimal lab without heavy resource requirements

Facets

infra-config · maturity abandoned

security monitoring logging infrastructure-as-code deployment security self-hosted windows dfir detection-lab vagrant packer ansible osquery sysmon splunk zeek suricata windows-domain security-tooling lab-environment devops linux terraform

Member repositories

For agents

markdown · JSON · MCP: product_card(name="clong/DetectionLab")