Overview

This progress update covers the next stage of the ElliottSecurity Enterprise Homelab: moving from reusable golden images into live lab workloads, Active Directory organizational foundations, and an operational Elastic telemetry path.

Live tracker: Lab Progress · Homelab project: Enterprise Cybersecurity Homelab.

---

What Advanced

Active Directory foundations

Organizational-unit structure and privileged-account hardening were established so users, computers, groups, and lab objects have clear homes before broader domain joins and Group Policy work.

Lab and analysis workloads

Windows and Kali lab systems were deployed for endpoint and authorized testing work. REMnux analysis capacity was brought online to support malware-analysis workflows, building on REMnux template infrastructure.

Elastic / Fleet telemetry

An internal Elastic Stack deployment is online with Fleet-based endpoint enrollment. A domain-joined Windows lab endpoint now reports Sysmon telemetry with confirmed ingestion — the first closed-loop monitoring path in the lab.

---

Why It Matters

Golden images alone do not prove a detection lab. Domain foundations, representative endpoints, analysis capacity, and a validated telemetry pipeline are what make detection engineering and threat hunting credible.

This milestone also reinforces secrets hygiene: temporary monitoring credentials and enrollment materials should be rotated through an approved secrets process and never published.

---

What Comes Next

• Continue monitoring platform hardening and threat-intel enrichment (see follow-up writeup)
• Expand endpoint telemetry coverage across additional lab systems
• Validate first detections against ingested Sysmon telemetry
• Build Group Policy baselines on the new OU model

Follow-up: Observability Hardening and Reliability.

---

Related

• Lab Progress
• Enterprise Cybersecurity Homelab
• Observability Hardening and Reliability
• Golden Template Engineering
• Identity and Remote Access Baseline
• Current Focus