Home labs & practical projects
Plan an emulation exercise with defender visibility
A project to do with your own tools, with guidance on what to create and capture.
What you could create
A security team proposes an internal adversary-emulation exercise. The operations team needs clear boundaries, telemetry expectations and a safe stop mechanism.
| Evidence | What to capture |
|---|---|
| Emulation exercise charter | Show the inputs, scope and decisions behind this record. The objective has a measurable success condition and bounded scope. |
| Defender telemetry and debrief matrix | Include the evidence supporting your conclusion. The plan can be stopped without relying on the operator who initiated it. |
What you'll need
Document, spreadsheet or diagram tool
Invent a training-only objective, authorised assets and defender contacts. Use a conceptual behaviour sequence without operational payloads or real infrastructure.
Project record
Keep the working files for emulation exercise charter and record assumptions as you go.
Current reference material
Use the linked provider resources to verify the features, access terms and version relevant to your project.
Access & cost
No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.
The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.
Suggested milestones
- 1
Plan and investigate
Define rules of engagement, approval and stop conditions.
- 2
Develop your approach
Map the planned behaviours to expected host and network evidence.
- 3
Verify and explain
Design the debrief around observed control performance and evidence gaps.
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Check relevance, platform versions and current access terms.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Invent a training-only objective, authorised assets and defender contacts. Use a conceptual behaviour sequence without operational payloads or real infrastructure.
What a good result looks like
- The objective has a measurable success condition and bounded scope.
- The plan can be stopped without relying on the operator who initiated it.
Finish the project
Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.