Security Lab / Threat Hunting

In Progress

Security OnionSIEMThreat HuntingBlue TeamDetection Engineering

Overview

Security Onion deployed on pve1 as an inline tap between the Firewalla Gold router and the Switch SE. The monitoring interface sits physically between router and switch seeing all traffic untagged. The Security Onion management interface lives on VLAN 33 (192.168.33.0/24), isolated from all other VLANs except Lab (VLAN 30) and Home (VLAN 10) for management access.

Inline Tap Architecture

pve1 has two NICs — one connected to the router, one to the switch. Security Onion's monitoring interface is untagged on the native VLAN and sees all traffic. Only the management interface is tagged on VLAN 33. This setup ensures the tap is transparent to the network and cannot be directly reached from threat lab VMs.

VLAN 60 — Threat Lab (Planned)

A dedicated threat hunting VLAN using 10.66.0.0/16 — deliberately different from the 192.168.x.0/24 pattern to make threat lab traffic instantly identifiable in Security Onion logs and packet captures. No internet by default. Management access comes inbound from VLAN 30 only. When VLAN 60 is stood up, tagged ports will be added to Switch SE ports 1 and 3 — not port 2, keeping threat lab VMs off wireless.

Planned Scenarios

Mock threat hunting exercises including lateral movement detection, C2 traffic identification, credential dumping alerts, and log analysis workflows using Security Onion's built-in detection rules and custom Sigma rules.