Purpose & Scope

This wiki documents the design and evolution of a modular purple team homelab, tailored for hands-on adversary emulation, detection engineering, and infrastructure hardening.

It is structured chapter by chapter, reflecting the live build process of the environment and the continuous integration of use-case-driven components.

I aim to build the lab as close as possible to an enterprise-grade, on-premise environment, with a long-term goal of extending it into a hybrid cloud setup that integrates Azure Active Directory and cloud-native components.

Key areas covered:

• End-to-end infrastructure planning and network segmentation
• Deployment of red, blue, and purple tooling in isolated lab environments
• TTP-focused adversary emulation using public threat intelligence
• Detection rule creation and validation using Sigma, YARA, and custom logic
• Integration of open-source platforms for visibility and response

Table of Contents

(To be expanded as the project grows)

Chapter 1: Lab Architecture

Outlines the core infrastructure of the purple team lab: network segmentation, virtualization stack, logical zones, and machine roles. Explains the reasoning behind architectural choices and the foundational setup decisions.

Chapter 2: Scenarios

Holds adversary emulation scenarios, including MITRE ATT&CK mappings, step-by-step TTPs, and lab execution guides.

Chapter 3: Automation & SOAR

Includes automation logic, SOAR playbooks, scripts, and integrations used to streamline detection, response, and enrichment.