> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/00-start-here/lab-environment.md).

# Lab Environment

ZyberLab begins with a small virtual environment. The objective is to keep the setup easy to understand and expand it only when a new lab requires additional systems.

## Current Architecture

```
Windows 11 Host
      |
VMware Workstation
      |
VMware NAT Network
      |
+----------------------+----------------------+----------------------+----------------------+
|                      |                      |                      |
DC01                 CLIENT01               KALI01                WAZUH01
Windows Server       Windows Client         Kali Linux            Wazuh Monitoring
Active Directory     Domain Member          Security Testing      Central Logging
DNS                  Sysmon                                       Dashboard
```

The environment now supports Windows, Active Directory, endpoint telemetry, network testing, investigation, and centralized security monitoring.

## Host Computer

The physical computer runs Windows 11 and VMware Workstation.

The host is responsible for:

* Running the virtual machines
* Providing virtual networking
* Creating and restoring VM snapshots
* Storing lab documentation and installation media

## Virtual Machines

### DC01, Windows Server

**Purpose:** Domain Controller and DNS server.

Current roles:

* Active Directory Domain Services
* DNS
* Domain users and groups
* Group Policy testing
* Windows security event generation
* Active Directory security monitoring
* Wazuh agent

Suggested hostname:

```
DC01
```

### CLIENT01, Windows Client

**Purpose:** Domain-joined Windows endpoint.

Used for:

* User sign-in testing
* Group Policy validation
* Windows Defender and firewall exercises
* Event Viewer
* Sysmon
* Endpoint security exercises
* Wazuh agent monitoring

Suggested hostname:

```
CLIENT01
```

### KALI01, Kali Linux

**Purpose:** Basic network and security testing workstation.

Used for beginner exercises such as:

* Connectivity testing
* Nmap scanning
* Basic service discovery
* Controlled web security exercises later

Suggested hostname:

```
KALI01
```

### WAZUH01, Security Monitoring

**Purpose:** Centralized security monitoring platform.

Used for:

* Collecting security telemetry from lab systems
* Monitoring Windows events
* Monitoring Active Directory events
* Reviewing Sysmon telemetry
* Searching security events
* Reviewing Wazuh alerts
* Supporting simple investigation workflows

Suggested hostname:

```
WAZUH01
```

`WAZUH01` should remain inside the trusted ZyberLab network. The dashboard should not be exposed directly to the public internet.

## Networking

The environment uses **VMware NAT** networking.

This keeps the lab simple because virtual machines can communicate with one another while still using the host's internet connection for updates and downloads.

A dedicated firewall, DMZ, VLANs, and multiple security zones are intentionally not part of the current build.

Those components can be introduced later when there is a specific learning objective that requires them.

## Future Expansion

Additional systems may be introduced gradually, such as:

* Ubuntu Linux
* OWASP Juice Shop
* Additional Windows clients
* Security Onion
* A virtual firewall

These are future components, not prerequisites for the current learning path.

## Naming Standard

Use short and predictable names so screenshots and documentation remain easy to follow.

| System         | Suggested Name | Purpose                         |
| -------------- | -------------- | ------------------------------- |
| Windows Server | `DC01`         | Domain Controller and DNS       |
| Windows Client | `CLIENT01`     | Domain-joined endpoint          |
| Kali Linux     | `KALI01`       | Security testing workstation    |
| Wazuh          | `WAZUH01`      | Centralized security monitoring |

As the lab grows, additional systems can follow the same pattern, such as `CLIENT02` or `SRV01`.

## Design Principle

**Do not build complexity before it is needed.**

The lab should grow alongside the learning path. Every new virtual machine, security tool, or network segment should have a clear reason for being added.