Ludus Overview

Hardware Requirements

The Ludus host that was used for creation the Ludus version of the Constructing Defense lab had the following specs:

  • 64GB RAM

  • 16 CPU Cores

  • 400GB Disk

You may be able to provision the lab on a host with 32GB of RAM and less CPU cores. The PCAP appliance Malcolm requires the most resources, so if you have a less provisioned host, you can choose not to run the Malcolm appliance and simply follow along with the videos and screenshots of the course.

General

The Ludus deployment option of the Constructing Defense lab automates the majority of the steps found within the "Lab Construction", "Lab Provisioning" and "Telemetry Setup & Miscellaneous Lab Configuration" sections of the course.

The Ludus deploy and associated Ansible roles provided for the course perform the following:

  • Stand up six virtual machines and a router

  • Stand up a condef.local domain

  • Set up of all relevant Group Policy objects

    • These include GPOs for certificate enrollment so ADCS attack paths work

    • These also include logging configurations

  • Domain join of all Windows virtual machines

  • Configuration and deploy of Sysmon

  • Configuration and deploy of Linux Auditd and Laurel

    • We are using Florian Roth's Auditd configuration with a few customizations to turn the noise down a bit for Docker

  • Installation of Sumo Logic collectors on all relevant hosts

  • Set up of Minikube / Kubernetes cluster

After the lab is deployed, there are a few additional steps required, these are outlined in the "Ludus Post Deploy Setup" section and include the following items:

  • Cloud account creation and collection configuration

  • Kubernetes telemetry collection

  • Malcolm setup

As a reminder, all sections of the course are totally optional to complete and you can choose to watch the videos or read the notes. For example, if you don't feel comfortable signing up for paid cloud services or do not have enough compute resources to add a Malcolm host to your lab.