Ludus Overview
Hardware Requirements
The Ludus host that was used for creation the Ludus version of the Constructing Defense lab had the following specs:
64GB RAM
16 CPU Cores
400GB Disk
You may be able to provision the lab on a host with 32GB of RAM and less CPU cores. The PCAP appliance Malcolm requires the most resources, so if you have a less provisioned host, you can choose not to run the Malcolm appliance and simply follow along with the videos and screenshots of the course.
General
The Ludus deployment option of the Constructing Defense lab automates the majority of the steps found within the "Lab Construction", "Lab Provisioning" and "Telemetry Setup & Miscellaneous Lab Configuration" sections of the course.
The Ludus deploy and associated Ansible roles provided for the course perform the following:
Stand up six virtual machines and a router
Stand up a
condef.localdomain-
Set up of all relevant Group Policy objects
These include GPOs for certificate enrollment so ADCS attack paths work
These also include logging configurations
Domain join of all Windows virtual machines
-
Configuration and deploy of Sysmon
We are using a customized version of Sysmon modular for the course
-
Configuration and deploy of Linux Auditd and Laurel
We are using Florian Roth's Auditd configuration with a few customizations to turn the noise down a bit for Docker
Installation of Sumo Logic collectors on all relevant hosts
Set up of Minikube / Kubernetes cluster
After the lab is deployed, there are a few additional steps required, these are outlined in the "Ludus Post Deploy Setup" section and include the following items:
Cloud account creation and collection configuration
Kubernetes telemetry collection
Malcolm setup
As a reminder, all sections of the course are totally optional to complete and you can choose to watch the videos or read the notes. For example, if you don't feel comfortable signing up for paid cloud services or do not have enough compute resources to add a Malcolm host to your lab.