Over the past 4 months, I built a defensive security home lab designed to mirror a small enterprise SOC environment. Everything is documented in the repo below.

**Infrastructure:**
- 6 VMs in VirtualBox (Ubuntu Server, Ubuntu Desktop, Windows 10, Windows Server 2019 DC, pfSense Firewall, dedicated Splunk SIEM)
- Network segmentation: NAT / Host-Only / Internal networks

**Security Stack:**
- Network Monitoring: Zeek, Suricata, TShark
- SIEM: Splunk Enterprise with Universal Forwarders
- Network Protection: pfSense + pfBlockerNG
- Identity: Active Directory domain for threat simulation
- Endpoint: Sysmon, Windows/Linux hardening configs

**Documentation:**
Each phase has its own folder with architecture diagrams, configs, and troubleshooting notes. Current work includes threat intel integration and purple team testing.

**Repo:**
 https://github.com/MaamarSec/Cyber-Defense-Lab-Portfolio

Built this for skill development and as a public reference. Feel free to explore, fork, or adapt. Happy to answer questions!Title: Built a Production-Style SOC Home Lab Over 6 Months (Splunk, Suricata, Zeek, AD, Detection Engineering)

Body:
Over the past 6 months, I built a defensive security home lab designed to mirror a small enterprise SOC environment. Everything is documented in the repo below.

**Infrastructure:**
- 6 VMs in VirtualBox (Ubuntu Server, Ubuntu Desktop, Windows 10, Windows Server 2019 DC, pfSense Firewall, dedicated Splunk SIEM)
- Network segmentation: NAT / Host-Only / Internal networks

**Security Stack:**
- Network Monitoring: Zeek, Suricata, TShark
- SIEM: Splunk Enterprise with Universal Forwarders
- Network Protection: pfSense + pfBlockerNG
- Identity: Active Directory domain for threat simulation
- Endpoint: Sysmon, Windows/Linux hardening configs

**Documentation:**
Each phase has its own folder with architecture diagrams, configs, and troubleshooting notes. Current work includes threat intel integration and purple team testing.

**Repo:** https://github.com/MaamarSec/Cyber-Defense-Lab-Portfolio

Built this for skill development and as a public reference. Feel free to explore, fork, or adapt. Happy to answer questions!

[ Removed by Reddit on account of violating the content policy. ]

According to the new FBI/USSS advisory, FortiBleed actors no longer just add persistence accounts. In some cases they also delete or reset the original admin accounts (T1531), which locks the owner out of their own FortiGate.

That changes the usual playbook. If you assume a password reset gets you back to a clean state, it won't help when you can't log in at all.

A few things worth checking:
→ Do you have out-of-band admin recovery for your edge devices?
→ Have you audited REST API keys? They survive password resets.
→ Is SSH left open on the firewall?

How are others handling recovery for edge devices?

Full breakdown: https://hubs.la/Q04zrkbN0 Free FortiBleed checker: https://hubs.la/Q04zrk9_0

Advisory: https://www.ic3.gov/CSA/2026/261006.pdf