> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/ad-lab-built-with-purpose/hardware-plan-and-scenario-slices.md). # Hardware Plan and Scenario Slices ### Hardware Plan and Scenario Slices | Host | Role | RAM | CPU | Storage | Management IP | | ----- | -------------- | ----- | -------- | ------- | ------------- | | SYS-1 | Endpoints | 4 GB | Intel i5 | 250 GB | 10.0.0.11 | | SYS-2 | Infrastructure | 10 GB | Intel i7 | 500 GB | 10.0.0.12 | **The fundamental constraint:** 14 GB total RAM cannot run 19 VMs simultaneously. Running the full overlap slice is technically possible but practically unreliable. When memory pressure hits, Elasticsearch heap crashes first and Zeek capture gaps follow. The lab is operated in scenario slices. If you try to run everything at once, you will get memory pressure, Elasticsearch heap crashes, and telemetry gaps. #### Scenario Slice Profiles | Slice | VMs Active | Approx RAM | Purpose | | ------------ | --------------------------------------------------------- | ---------- | -------------------------------------------------- | | AD Identity | Both DCs + pfSense + 2 workstations | \~5 GB | Trust setup, LDAP enumeration, Kerberos validation | | Attack | Both DCs + pfSense + Kali + 2 workstations + file servers | \~8 GB | Active attack scenario execution | | Detection | Both DCs + pfSense + SEC-ONION + 1–2 workstations | \~9 GB | Telemetry validation, alert tuning | | Full Overlap | All of the above simultaneously | \~12–13 GB | Heavy load expect instability on SYS-2 | Running the full overlap slice is technically possible but practically unreliable for detection timing. When you need to validate that a detection rule fires, use the Detection slice with pre-recorded attack artifacts rather than running Kali live alongside Security Onion. *** ## VM Build List ### USA Domain | VM Name | OS | RAM | Disk | IP | Role / User | Host | | --------- | ------------------------ | ------ | ----- | ----------- | ----------------- | ----- | | DC-USA | Windows Server 2022 Core | 1.5 GB | 40 GB | 10.10.0.10 | Domain Controller | SYS-2 | | FILE-USA | Ubuntu 22.04 LXC | 512 MB | 80 GB | 10.10.0.20 | Samba / AD-Joined | SYS-1 | | WEB-USA | Ubuntu 22.04 LXC | 256 MB | 15 GB | 10.10.0.30 | Apache Intranet | SYS-2 | | MAIL-USA | Ubuntu 22.04 LXC | 256 MB | 15 GB | 10.10.0.40 | Postfix Relay | SYS-2 | | WS-USA-01 | Windows 10 LTSC | 1 GB | 30 GB | 10.10.0.101 | HR / sjones | SYS-1 | | WS-USA-02 | Windows 10 LTSC | 1 GB | 30 GB | 10.10.0.102 | Finance / mchen | SYS-1 | | WS-USA-03 | Windows 10 LTSC | 1 GB | 30 GB | 10.10.0.103 | IT Admin / lpark | SYS-1 | | WS-USA-04 | Windows 10 LTSC | 768 MB | 30 GB | 10.10.0.104 | DevOps / dwilson | SYS-1 | ### India Domain | VM Name | OS | RAM | Disk | IP | Role / User | Host | | --------- | ------------------------ | ------ | ----- | ----------- | ----------------- | ----- | | DC-INDIA | Windows Server 2022 Core | 1.5 GB | 40 GB | 10.20.0.10 | Domain Controller | SYS-2 | | FILE-IND | Ubuntu 22.04 LXC | 256 MB | 60 GB | 10.20.0.20 | Samba / AD-Joined | SYS-1 | | WEB-IND | Ubuntu 22.04 LXC | 256 MB | 15 GB | 10.20.0.30 | Apache Intranet | SYS-2 | | MAIL-IND | Ubuntu 22.04 LXC | 256 MB | 15 GB | 10.20.0.40 | Postfix Relay | SYS-2 | | WS-IND-01 | Windows 10 LTSC | 1 GB | 30 GB | 10.20.0.101 | HR / psharma | SYS-1 | | WS-IND-02 | Windows 10 LTSC | 1 GB | 30 GB | 10.20.0.102 | Finance / apatel | SYS-1 | | WS-IND-03 | Windows 10 LTSC | 768 MB | 30 GB | 10.20.0.103 | IT Admin / dnair | SYS-2 | | WS-IND-04 | Windows 10 LTSC | 768 MB | 30 GB | 10.20.0.104 | DevOps / vsingh | SYS-2 | ### Infrastructure | VM Name | OS | RAM | Disk | IP | Role | Host | | --------- | ------------------ | ------ | ------ | --------- | ----------------------- | ----- | | PFSENSE | pfSense CE 2.7 | 512 MB | 8 GB | 10.0.0.1 | Router / VPN / Firewall | SYS-2 | | SEC-ONION | Security Onion 2.4 | 4 GB | 200 GB | 10.0.0.50 | Detection Stack | SYS-2 | | KALI-01 | Kali Linux 2024.x | 2 GB | 60 GB | 10.0.0.99 | Attack Platform | SYS-2 | On Windows Server 2022 Core at 1.5 GB RAM: it boots and functions. With AD DS, DNS, Wazuh agent, and Sysmon running, you are operating at the functional minimum rather than a production-equivalent workload. Trust operations and Kerberos negotiation work correctly at this allocation. If additional memory is available, allocating 3 GB or more per domain controller will provide a noticeably better experience. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://blog.r00t-hunter.com/ad-lab-built-with-purpose/hardware-plan-and-scenario-slices.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.