About

We know that cybersecurity is no joke. With an ever-increasing number of security threats, organizations need to be able to identify vulnerabilities in their security defenses and take appropriate action. That's why we've created Security Insight Cyber Lab - a comprehensive testing, red and blue teaming environment that enables cybersecurity professionals to simulate and test real-world attack scenarios, identify vulnerabilities, and monitor and analyze logs generated in Microsoft Sentinel by these attacks to detect potential security threats and take appropriate action.

Fast deployment? Check. Real-world attack simulations? Check. Comprehensive toolkit? Check. Improved security posture? Check. Security Insight Cyber Lab has nearly got it all. With Security Insight Cyber Lab, cybersecurity professionals can simulate and test a wide range of real-world attack scenarios in a safe and controlled environment, write custom analytics and detections in Microsoft Sentinel in order to take appropriate action to protect their organization.

Built on Microsoft Sentinel, Security Insight Cyber Lab includes a Windows Domain, Windows workstations, Kali Linux, & Atomic Red Team to provide a comprehensive toolkit for cybersecurity professionals.

So, if you're looking to improve your organization's security posture and stay one step ahead of the bad guys, look no further than Security Insight Cyber Lab - the comprehensive testing, red and blue teaming environment that enables cybersecurity professionals to simulate and test real-world attack scenarios, identify vulnerabilities, and write custom analytics and detection rules in Microsoft Sentinel.

Security Insight Cyber Lab can also be used for for learning Microsoft Sentinel and the common tools used by security analysis and researchers.

Security Insight Cyber Lab is part of the Security Insight portfolio which includes;

Security Insight Threat Intelligence - Provides threat intelligence feed for Microsoft Sentinel deployments.

Security Insight Foundations - Rapid deployment of Microsoft Sentinel with Threat Intelligence.

Security Insight Enterprise - CI/CD pipeline based deployment of Microsoft Sentinel with Threat Intelligence for organisations that want to rapidly deploy and manage Microsoft Sentinel and Microsoft Sentinel content.

Benefits

Fast deployment: With Security Insight Cyber Lab, you can reduce time to value for security analyst specialists to have a test environment.
Real-world attack simulations: Security Insight Cyber Lab enables cybersecurity professionals to simulate and test a wide range of real-world attack scenarios.
Comprehensive toolkit: Security Insight Cyber Lab includes a Windows Domain, Windows workstations (with AMA Agent & Sysmon pre-configured), Kali Linux, Atomic Red Team, and Microsoft Sentinel to provide a comprehensive toolkit for creating and testing custom analytics and playbooks for Microsoft Sentinel.
Improved security posture: By using Security Insight Cyber Lab, you can identify vulnerabilities in your organization's security defenses, monitor and analyze logs generated by these attacks to detect potential security threats, and write (and test) custom analytics and detection rules for these attacks in Microsoft Sentinel.
Create & Destroy as needed: Save time and money in only running Security Insight CyberLab when needed. Need a lab? Deploy in under an hour. Finished with the lab? Delete it and only pay for the time that you needed it.

Deployment Instructions

Create an empty resource group for the deployment (this can be done as part of the deployment)
Select the components required being sure to note both the usernames and passwords for the Virtual Machines
Once the deployment is complete (takes around 45 minutes to 1 hour depending on components selected) log in to VM's using Azure Bastion

Post Deployment Tasks

1. Log in to each VM using Azure Bastion.

2. Use the attacks tools to create custom analytics, detection rules and/ or playbooks.

3. Transfer the analytics, rules, playbooks to your Production Microsoft Sentinel/ Security Insight deployment.

4. Finished? Delete the resource group and the lab will be deleted.

5. Paused? Set the VMs to auto-shutdown to prevent paying for the compute costs when the lab isn't needed.

Security Insight Cyber Lab

by LAB3 Solutions