01
Home SOC Lab
One command starts a SIEM, a victim host, and an attacker host. Nothing is click-built.
A security operations lab that rebuilds itself from a git clone. Every image is pinned by digest, because tags move and digests do not.
The architecture decision it records is the interesting part. The lab was specified as Ubuntu plus a Windows victim plus an attacker box. On Apple Silicon that is not buildable as written: x86 Windows will not virtualise. Rather than quietly drop the Windows telemetry, the lab replays committed Sysmon and EVTX sample sets from pinned public datasets — which costs fidelity and buys replication on any host, x86 or arm64. That trade is written down in the repository, not hidden.