Isolated range
Kali, Windows/AD and vulnerable Linux targets on a hard-coded lab network. Review the plan before anything runs.
SCOPE GUARD · PREVIEW → RUN
NOW // DETECTION LAB V5 · 6 CHANNELS · 13 RULES →
RANGE//ZERO
ISOLATED CYBER RANGE // BLUE TEAM LAB // LOCAL ONLY
We don’t build fake
breaches. We build a range
where real attacks become evidence.
breaches. We build a range
where real attacks become evidence.
Kali → Windows/AD and vulnerable Linux targets on an isolated 10.10.10.0/24. Curated scenarios, hard scope guard, real telemetry and reports that keep their receipts.
6LIVE TELEMETRY CHANNELS
13DETECTION RULES
55/55LOCAL TESTS PASSING
100%LOCAL · NO TELEMETRY
01 // LATEST EVIDENCE LIVE
NOW SHIPPINGDetection isn’t a feature.
Detection isn’t a feature.
It’s the operating model.
Six telemetry channels. A versioned rule pack. High signals sorted above noise. Every alert links back to a real event — not a decorative demo.
READ THE DETECTION PROOF →EVENTS1,000
ALERTS233
HIGH26
RULE PACK2026.11.06
Windows Security · System · PowerShell · Kali journal · Suricata · wired Sysmon
02 // CAPABILITIESREAL SYSTEMS, REAL LIMITS
Detection Lab
Windows Security/System/PowerShell, Kali journal and Suricata IDS in one evidence timeline. Versioned rules, real source health.
6 CHANNELS · 13 RULESShield
Evidence-backed posture across app, privacy, host, network and lab. Reversible hardening previews and cited playbooks.
POSTURE HISTORY · PLAYBOOKSReports
Live assets, NIST/CIS/ISO control mappings with honest gaps, detection evidence and JSON/Markdown export.
15 ASSETS · 10 CONTROLS03 // PROOFEVERY ARC = REAL EVENT
Attack. Detect.
Prove. Report.
When the Kerberoast scenario runs, the Attack Board arc, the $krb5tgs$ evidence and the detection alert all come from the same isolated lab. The app shows the scope result and the raw transcript.
2/2STEPS VERIFIED
T1558.003KERBEROAST
PASSSCOPE GUARD
04 // WHAT IT IS NOTNO HYPE. NO GUARANTEES.
Not untraceable
No anonymity guarantee. The lab is isolated and local; identity safety is a separate, verified lane.
Not a public exploit service
Practice only against the isolated lab or systems with written authorization.
Not a full SIEM/EDR
Detection Lab v5 is real but narrow. Wazuh/ELK and endpoint sensors are future work.
Not production-ready
No accounts/MFA, multi-tenancy, SLA or external audit yet. This is a private pilot.
05 // CONNECTINVITE-ONLY PILOT
High-signal
connections only.
The public pilot is invite-only. The waitlist opens after the owner approves the privacy and pilot terms; no email is collected here. Practice stays in the isolated lab or systems with written authorization.
BACK TO THE RANGE →NO DATA COLLECTION · NO PAYMENT