Purple › Module 1 › Lesson 2
Lab Hosts Only
Lab hosts only means YOUR authorized VMs and endpoints under $PURPLE_LAB — labeled courseware targets, self-authored host inventory — document host scope in notes before any simulation.
Visual · t35_lab_hosts_only
Lab host scope. $PURPLE_LAB only. Original Cyberlium.
Opening
The host owner is part of scope — Cyberlium refuses attack simulations on stranger production networks or cloud tenants you do not have authorization to exercise.
Your purple lab hosts are VMs and endpoints YOU operate — CYBERLIUM-LAB-WIN01, CYBERLIUM-LAB-LNX01, labeled courseware simulation targets on example.local VLANs. Simulations live on $PURPLE_LAB only — never copied from live breach replays or run against stranger cloud subscriptions. Cyberlium maps allowed host inventory on YOUR $PURPLE_LAB — hostname, OS, simulation role, fictional org label — never 'borrowed' employer production endpoints or scraped live victim infrastructure. Next: No Stranger Sims.
1. Allowed lab host surfaces (named)
Self-authored lab VMs with fictional org names. Courseware purple packs with explicit training labels. Isolated lab VLAN diagrams with example.local assets. Simulation targets enrolled in YOUR EDR lab tenant only.
On $PURPLE_LAB, list host inventory row — hostname, OS, simulation role, fictional org label — never paste live victim infrastructure from public dumps.
Command guide
Try these commands — Allowed lab host surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Splunk security content — https://github.com/splunk/security_content
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t35-purple/notes" "$HOME/cyberlium-lab/t35-purple/rules" "$HOME/cyberlium-lab/t35-purple/telemetry" "$HOME/cyberlium-lab/t35-purple/testing" "$HOME/cyberlium-lab/t35-purple/atomic" "$HOME/cyberlium-lab/t35-purple/exercises" "$HOME/cyberlium-lab/t35-purple/coverage" "$HOME/cyberlium-lab/t35-purple/findings" cat > "$HOME/cyberlium-lab/t35-purple/lab.env" <<'EOF' export PURPLE_LAB=$HOME/cyberlium-lab/t35-purple export PURPLE_LAB_RULES=$HOME/cyberlium-lab/t35-purple/rules export PURPLE_LAB_TELEMETRY=$HOME/cyberlium-lab/t35-purple/telemetry export PURPLE_LAB_EXERCISES=$HOME/cyberlium-lab/t35-purple/exercises export PURPLE_LAB_COVERAGE=$HOME/cyberlium-lab/t35-purple/coverage EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t35-purple/lab.env" grep -E 'PURPLE_LAB' "$HOME/cyberlium-lab/t35-purple/lab.env" curl -sS https://github.com/splunk/security_content | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Splunk security content (https://github.com/splunk/security_content). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why lab host scope matters before simulations
Attack simulation tools — Atomic Red Team, CALDERA, custom scripts — are powerful on any network. Scope is what keeps practice legal and ethical. Employer production endpoints, live breach replays, and stranger-network simulations are out of scope.
If you cannot answer 'who owns this host and is it labeled lab-only?', pause and fix scope notes before running the simulation.
3. Lab host inventory habit
Forbidden: importing live breach infrastructure because they 'look like training.' Allowed: host inventory row — hostname, role, fictional org, source = $PURPLE_LAB self-authored.
Ship: lab host inventory row for three fictional targets. Next: No Stranger Sims.
4. What you ship: lab host inventory row for $PURPLE_LAB
Three fictional lab hosts with role labels. $PURPLE_LAB named. NEVER live victim infrastructure. chmod 600.
5. What you record before the next lesson
Date. Lab host inventory row. $PURPLE_LAB named. File t35-m01-l02-lab-hosts-only.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import live breach host list because lab targets are boring. Skip host label because 'it's just a sim.'
Right
Write lab host inventory row for YOUR $PURPLE_LAB. Next: No Stranger Sims.
Mission: document YOUR lab host inventory
1) Write three fictional lab hosts. 2) Label each as lab-only with simulation role. 3) Confirm zero live victim infrastructure. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Lab host inventory exists for scope — use it instead of live victim infrastructure replays.
Knowledge Check
APPLY: Lab hosts only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Simulation on $PURPLE_LAB uses YOUR lab hosts with explicit labels.
True or False
Knowledge Check
APPLY: Before running attack simulations you should:
Multiple choice