Lab 01 — Build Your Cybersecurity Analyst Lab Environment

Mission Information

Item	Details
Lab	01
Lab Name	Build Your Cybersecurity Analyst Lab Environment
Track	CompTIA CySA+
Difficulty	Beginner
Estimated Time	60–90 minutes
Primary Role	Cybersecurity Analyst / SOC Analyst
Environment	Local Virtual Lab
Primary Systems	Windows + Linux
Skills	Virtualization, networking, logging, security monitoring, analyst workstation setup

Mission Scenario

Welcome to your first CompTIA CySA+ hands-on mission.

You have joined the security operations team of a fictional organization called GHC Enterprise.

The organization is building a small Security Operations Center (SOC), and your first responsibility is to prepare an isolated environment where analysts can safely:

• collect security logs

• analyze suspicious activity

• investigate endpoints

• inspect network traffic

• perform vulnerability assessments

• investigate security alerts

• practice incident response

• conduct threat hunting

Instead of installing tools directly on production systems, you will create a dedicated Cybersecurity Analyst Lab.

This environment will become the foundation for the CySA+ labs that follow.

Mission Objective: Build a safe, reusable cybersecurity analysis environment containing an analyst workstation and monitored Windows and Linux endpoints.

---

1. What You Will Build

Your initial environment will contain three primary systems.

                    CySA+ Security Lab
                           |
                    Virtual Network
                           |
          +----------------+----------------+
          |                |                |
          |                |                |
     Analyst VM       Windows VM        Linux VM
     Kali Linux       Windows 11        Ubuntu Server
          |                |                |
          |                |                |
     Investigation      Endpoint          Server
        Tools            Logs              Logs

System Roles

System	Purpose
Analyst Workstation	Security investigation and analysis
Windows Endpoint	Generate Windows security telemetry
Linux Server	Generate Linux authentication and system telemetry

Later labs will extend this architecture with technologies such as:

SIEM
IDS/IPS
Zeek
Suricata
Vulnerability Scanner
Threat Intelligence
Endpoint Telemetry
Detection Rules
Threat Hunting

---

2. Learning Objectives

By completing this lab, you will be able to:

• build an isolated cybersecurity analysis environment

• understand basic SOC lab architecture

• configure multiple virtual machines

• configure virtual networking

• verify communication between lab systems

• identify important Windows security logs

• identify important Linux security logs

• install basic analyst utilities

• generate security events

• validate that systems are ready for future monitoring

• document a basic security lab environment

---

3. Why This Matters for CySA+

CompTIA CySA+ focuses heavily on the analyst’s ability to interpret security information rather than simply memorize security technologies.

A cybersecurity analyst regularly works with:

• endpoint telemetry

• authentication events

• network traffic

• SIEM alerts

• vulnerability information

• indicators of compromise

• threat intelligence

• incident evidence

This lab gives you a controlled environment where those activities can be practiced repeatedly.

---

4. Prerequisites

Before beginning, you should understand:

• basic operating system concepts

• IP addressing

• basic TCP/IP networking

• Windows administration fundamentals

• Linux command-line fundamentals

You should also have approximately:

• 16 GB RAM recommended

• 100+ GB available disk space

• virtualization support enabled

• internet access for initial downloads

Systems with fewer resources can still complete the lab by running fewer virtual machines simultaneously.

---

5. Choose Your Virtualization Platform

You can use a virtualization platform such as:

• Oracle VirtualBox

• VMware Workstation

• VMware Fusion on supported Mac systems

• another hypervisor capable of running the required operating systems

For this learning path, the important concept is the architecture rather than the specific hypervisor.

---

6. Create the Lab Folder Structure

Before creating the virtual machines, establish an organized workspace.

Example:

CySA-Lab/
│
├── VMs/
│   ├── Analyst/
│   ├── Windows/
│   └── Linux/
│
├── Evidence/
│   ├── Logs/
│   ├── PCAP/
│   ├── Screenshots/
│   └── Indicators/
│
├── Investigations/
│
├── Reports/
│
└── Notes/

This introduces an important analyst habit:

Keep evidence, investigation notes, and reports organized from the beginning.

---

7. Create the Lab Network

Create an isolated virtual network.

Example network:

Network: 10.10.10.0/24

Assign the following addresses:

System	IP Address
Analyst Workstation	10.10.10.10
Windows Endpoint	10.10.10.20
Linux Server	10.10.10.30

Example:

10.10.10.0/24

10.10.10.10   Analyst
10.10.10.20   Windows
10.10.10.30   Linux

Do not expose intentionally vulnerable services directly to the public internet.

For later attack simulations, use the isolated lab network.

---

8. Build the Analyst Workstation

Your analyst workstation will be the primary system used throughout the labs.

A Kali Linux VM is convenient because many security analysis utilities are already available.

Recommended configuration:

Hostname: CYSA-ANALYST

CPU: 2–4 vCPU
RAM: 4 GB minimum
Disk: 40–60 GB
IP: 10.10.10.10

After installation, open a terminal.

Verify your identity:

whoami

Check the hostname:

hostname

Check network interfaces:

ip addr

Check routing:

ip route

---

9. Update the Analyst Workstation

Update the package information:

sudo apt update

Install available updates:

sudo apt upgrade

Install useful utilities:

sudo apt install curl wget git jq tcpdump net-tools dnsutils

These tools will be used throughout future investigations.

---

10. Verify Core Security Tools

Check whether Wireshark is available:

wireshark --version

Check Nmap:

nmap --version

Check tcpdump:

tcpdump --version

Check curl:

curl --version

You do not need every security tool installed yet.

Additional technologies will be introduced when their corresponding labs require them.

---

11. Build the Windows Endpoint

Create a Windows virtual machine.

Recommended configuration:

Hostname: CYSA-WIN01

CPU: 2 vCPU
RAM: 4 GB
Disk: 50 GB
IP: 10.10.10.20

After installation, rename the computer if necessary.

Open PowerShell as Administrator.

Check the hostname:

hostname

Check network configuration:

ipconfig /all

Verify the Windows version:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion

---

12. Explore Windows Security Logs

Windows Event Logs are one of the most important telemetry sources for security analysts.

Open:

Event Viewer

Navigate to:

Windows Logs
    ├── Application
    ├── Security
    ├── Setup
    └── System

Spend several minutes examining the events.

Pay attention to:

Timestamp
Event ID
Source
User
Computer
Event Details

---

13. Query Windows Security Events with PowerShell

Instead of relying entirely on the GUI, analysts should become comfortable querying logs programmatically.

Run:

Get-WinEvent -LogName Security -MaxEvents 10

Display selected fields:

Get-WinEvent -LogName Security -MaxEvents 10 |
Select-Object TimeCreated, Id, ProviderName

You should see recent security events.

---

14. Investigate Authentication Events

Authentication telemetry is extremely important during incident investigations.

Common Windows Event IDs include:

Event ID	Meaning
4624	Successful logon
4625	Failed logon
4634	Account logged off
4648	Logon using explicit credentials
4672	Special privileges assigned
4688	Process creation

Query successful logons:

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4624
} -MaxEvents 10

If no events appear, generate additional login activity and try again.

---

15. Generate a Windows Security Event

Lock the Windows workstation:

Windows Key + L

Log back in.

Return to PowerShell and search for recent successful logons:

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4624
} -MaxEvents 5

You have now generated and investigated your first authentication telemetry.

---

16. Enable Process Creation Auditing

Process execution is extremely valuable during security investigations.

Open:

Local Security Policy

Navigate to:

Advanced Audit Policy Configuration
→ System Audit Policies
→ Detailed Tracking
→ Audit Process Creation

Enable:

Success

Apply the configuration.

Open Command Prompt or PowerShell and run:

whoami

Then:

ipconfig

Query process creation events:

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4688
} -MaxEvents 10

You should begin seeing process creation telemetry.

---

17. Build the Linux Server

Create an Ubuntu Server VM.

Recommended configuration:

Hostname: CYSA-LINUX01

CPU: 2 vCPU
RAM: 2–4 GB
Disk: 30 GB
IP: 10.10.10.30

After installation:

hostname

Verify the IP address:

ip addr

Check routing:

ip route

---

18. Update the Linux Server

Run:

sudo apt update

Then:

sudo apt upgrade

Install several basic utilities:

sudo apt install curl wget net-tools openssh-server

Check SSH:

sudo systemctl status ssh

If required:

sudo systemctl enable --now ssh

---

19. Explore Linux Security Logs

Linux systems commonly store logs under:

/var/log/

List the directory:

ls -lah /var/log/

Depending on the distribution and logging configuration, important telemetry may include:

/var/log/auth.log
/var/log/syslog
/var/log/kern.log

View authentication activity:

sudo tail /var/log/auth.log

Monitor it in real time:

sudo tail -f /var/log/auth.log

Press:

Ctrl + C

to stop monitoring.

---

20. Explore systemd Journal Logs

Modern Linux environments commonly use systemd-journald.

Display recent events:

journalctl -n 20

View SSH service events:

sudo journalctl -u ssh

Display recent errors:

journalctl -p err

Security analysts should be comfortable working with both traditional log files and journalctl.

---

21. Verify Lab Connectivity

From the analyst workstation:

ping 10.10.10.20

Then:

ping 10.10.10.30

Expected architecture:

CYSA-ANALYST
10.10.10.10
      |
      +------> CYSA-WIN01
      |        10.10.10.20
      |
      +------> CYSA-LINUX01
               10.10.10.30

If ping fails, investigate:

• virtual network configuration

• IP addresses

• subnet masks

• Windows Firewall

• Linux firewall

• virtual adapters

Troubleshooting connectivity is itself an important analyst skill.

---

22. Test Linux SSH Connectivity

From the analyst workstation:

ssh <username>@10.10.10.30

Replace <username> with your Linux account.

After successfully connecting, run:

whoami

Then:

hostname

Exit:

exit

---

23. Investigate the SSH Login

Return to the Linux server.

Run:

sudo grep ssh /var/log/auth.log | tail

Or:

sudo journalctl -u ssh --since "10 minutes ago"

Look for information such as:

Source IP
Username
Authentication Result
Timestamp
SSH Process

You have now generated a remote authentication event and investigated its telemetry.

---

24. Capture Your First Network Traffic

Return to the analyst workstation.

Identify the correct network interface:

ip addr

Start a packet capture:

sudo tcpdump -i <interface>

Replace <interface> with your lab network interface.

Generate traffic by pinging the Linux server:

ping 10.10.10.30

Observe the packets.

Stop the capture using:

Ctrl + C

---

25. Save Network Evidence

Capture traffic to a file:

sudo tcpdump -i <interface> -w cysa-lab01.pcap

Generate traffic between your systems.

Stop the capture.

Verify the file:

ls -lh cysa-lab01.pcap

You have created your first packet-capture evidence file.

This file can later be analyzed with Wireshark.

---

26. Create Your Analyst Evidence Workspace

On your analyst workstation:

mkdir -p ~/CySA-Lab/{Evidence,Investigations,Reports,Notes}

Inside Evidence:

mkdir -p ~/CySA-Lab/Evidence/{Logs,PCAP,Screenshots,Indicators}

Move the packet capture:

mv cysa-lab01.pcap ~/CySA-Lab/Evidence/PCAP/

Verify:

find ~/CySA-Lab -type f

---

27. Take Virtual Machine Snapshots

Once all systems are functioning correctly, create snapshots.

Recommended snapshot names:

CYSA-ANALYST
Snapshot: Lab01-Clean

CYSA-WIN01
Snapshot: Lab01-Clean

CYSA-LINUX01
Snapshot: Lab01-Clean

Snapshots provide a known-good state you can return to after future attack simulations or configuration changes.

---

28. Build Your Asset Inventory

Document your environment.

Example:

Asset	Hostname	IP	Role	OS
Analyst	CYSA-ANALYST	10.10.10.10	Investigation	Kali Linux
Endpoint	CYSA-WIN01	10.10.10.20	User Endpoint	Windows
Server	CYSA-LINUX01	10.10.10.30	Linux Server	Ubuntu

Save this information in:

CySA-Lab/Notes/Lab-Asset-Inventory.md

Maintaining an accurate asset inventory is an important part of security operations.

---

29. Mission Challenge

You have configured the environment.

Now perform a small investigation without following exact commands.

Scenario

A security analyst reports that someone recently connected to:

CYSA-LINUX01

using SSH.

Determine:

1. When did the connection occur?

2. Which account authenticated?

3. What source IP initiated the connection?

4. Was authentication successful?

5. Which log source contains the evidence?

Record your findings.

Example investigation record:

Incident:
LAB01-SSH-001

System:
CYSA-LINUX01

Event:
Remote SSH authentication

Source:
10.10.10.x

Account:
<username>

Result:
Successful / Failed

Evidence Source:
Linux authentication logs / systemd journal

Do not worry about producing a full incident report yet.

That skill will be developed in later labs.

---

30. Validation Checklist

Before completing the mission, verify:

• Analyst virtual machine is operational

• Windows endpoint is operational

• Linux server is operational

• All systems use the isolated lab network

• IP addresses are documented

• Analyst workstation can communicate with both endpoints

• Windows Event Viewer is accessible

• Windows Security events can be queried

• Linux authentication logs can be investigated

• SSH telemetry has been generated

• Network traffic has been captured

• PCAP evidence has been saved

• Evidence folders have been created

• Asset inventory has been documented

• Clean VM snapshots have been created

---

31. Evidence to Capture

Save evidence demonstrating successful completion of the mission.

Capture:

01-analyst-ip.png
02-windows-ip.png
03-linux-ip.png
04-windows-security-events.png
05-windows-4624-event.png
06-linux-authentication-log.png
07-ssh-investigation.png
08-network-connectivity.png
09-packet-capture.png
10-vm-snapshots.png

Place the evidence under:

CySA-Lab/
└── Evidence/
    ├── Logs/
    ├── PCAP/
    │   └── cysa-lab01.pcap
    └── Screenshots/

---

32. Mission Review

You started this lab with individual operating systems.

You now have a small cybersecurity analysis environment containing:

Analyst Workstation
        ↓
Isolated Security Network
        ↓
Windows + Linux Systems
        ↓
Security Telemetry
        ↓
Logs + Network Evidence
        ↓
Analyst Investigation

More importantly, you performed the beginning of the same workflow used in security operations:

Generate Activity
        ↓
Collect Telemetry
        ↓
Identify Evidence
        ↓
Investigate Activity
        ↓
Document Findings

That workflow will become progressively more advanced throughout the CySA+ labs.

---

Skills Developed

After completing this mission, you should understand:

• cybersecurity analyst lab architecture

• virtual security environments

• endpoint telemetry

• Windows Event Logs

• Linux security logs

• authentication telemetry

• basic packet capture

• evidence organization

• security investigation fundamentals

---

What’s Next?

Lab 02 — Security Log Analysis Fundamentals

Your environment is ready.

In the next lab, you will move from building the environment to investigating security telemetry.

You will work with multiple log sources and learn how analysts identify:

• successful and failed authentication

• suspicious login patterns

• unusual system activity

• important timestamps

• usernames and source addresses

• event IDs

• related events

• potential indicators of compromise

The goal is to begin thinking like a cybersecurity analyst:

Don’t look at an event in isolation. Build the story around it.

➡️ Next: Lab 02 — Security Log Analysis Fundamentals