Setting up a research environment

Before carrying out a hunt in our production environment, we need to prepare a laboratory environment in which emulate the threat to hunt it first. There isn’t a unique or right way to build a research environment. The requirements will change depending on where and what you are planning to deploy. Could be that you want to create a lab to do research by yourself, or that you want to deploy a lab that will mimic your organizations infrastructure to emulate the adversary to carry out hunts in a production environment later on. You could also create a research environment that focuses more on network traffic analysis or in host related artifacts.

In this chapter we are going to build a research environment pretty similar to the one I host myself and described by Roberto Rodriguez in his personal blog: Setting up a Pentesting… I mean, a Threat Hunting Lab (https://cyberwardog.blogspot.com/2017/02/setting-up-pentesting-i-mean-threat.html). This...