search

splunk / attack_range_local

Build a attack range in your local machine
Apache License 2.0
130 stars 39 forks source link

Request for documentation clarification #33

Closed ghost closed 3 years ago

ghost commented 3 years ago

First of all, thank you for developing this project. I am eager to set up this range and start learning more about splunk.

My concern is that as a "noob", I am finding it difficult to know where to start from the documentation. For instance, what are the pre-requisites for setting up this range? I see Ubuntu mentioned and virtual box in the readme, but what does that mean exactly? For instance, do I run all of this from a Ubuntu VM that is running virtual box and have a nested setup, or does this need to be a bare metal Ubuntu install with virtual box installed? I am currently a windows user with VMware installed, so I am trying to figure out what I need to do to get this range up and going on a local server that is running the same.

Any clarification would be greatly appreciated. Thank you!

kseidenschnur commented 3 years ago

Hello, I am sorry that the documentation is not very clear here. We are currently reworking the Wiki and hope to have that updated soon. Basically you will need a Ubuntu 18.04 Desktop machine in where you will setup AR. I am running that on VMWare Workstation on Windows, just as you. Have Ubuntu ready and follow these steps: https://github.com/splunk/attack_range_local/wiki/Ubuntu-18.04-Installation Make sure that your Ubuntu machine has enough ressources, you will need to run a Splunk machine and at least a Windows Domain Controller. Have a look into the attack_range_local.conf where you can configure which machine to build including hardware specs to be used.

I hope this helps as a start!

kseidenschnur commented 3 years ago

Have a look here for the "beta" wiki: https://github.com/kseidenschnur/attack_range_local/wiki

ghost commented 3 years ago

@kseidenschnur Thank you for your help. So is this to say that I need to have boxes already installed, or does this use vagrant boxes that are downloaded and pre-configured?

kseidenschnur commented 3 years ago

@jwb4k3r It will use vagrant and ansible to build the whole environment for you based on the configuration in attack_range_local.conf.