David Spurlock
RésuméContact
Menu

Technical project· Detection engineering

Cyber Range Red/Blue Lab

A local Docker range for observing, detecting, investigating, and retesting controlled web-security events through a bounded gateway-to-Elastic telemetry path.

This page documents a later portfolio reconstruction of a project originally completed during the ASU Cybersecurity Boot Camp in 2020. The current code, data, screenshots, and reports are not the untouched original submission.

ASU Cybersecurity Boot Camp · 2020Reviewed July 2026
← Back to all projects
OWASP Juice Shop storefront showing Apple Juice, Apple Pomace, and Banana Juice products in the reconstructed cyber-range target.
OWASP Juice Shop is the deliberately vulnerable local web target used to generate controlled activity inside the reconstructed range.
For
Recruiters and technical reviewers evaluating how a controlled local range connects target activity, telemetry, detection, investigation, hardening, and retesting.
Role
Original bootcamp project work; later lab architecture, detection content, evidence workflow, hardening, and release validation
Build
Later portfolio reconstruction of an original bootcamp project

The problem

Why this needed to exist.

Security labs often demonstrate an attack or a dashboard in isolation. This project keeps the target, ingress, telemetry, detections, investigation evidence, and remediation retest in one reproducible boundary.

Defining decision

Keep the target, ingress, telemetry, detections, investigation evidence, and retest inside one bounded local environment.

Approach

How the system was shaped.

  1. Restricted all scenario traffic to repository-created containers and removed configurable public targets.
  2. Mapped deterministic events to local detection rules and linked the resulting alerts to analyst queries, a timeline, and technical and executive reports.
  3. Reused identical inputs after gateway and container hardening so the retest remained comparable.

Tradeoffs

What the design chooses—and gives up.

  • A single-node local environment is portable and auditable but does not model production-scale telemetry.
  • Synthetic control events support deterministic testing without claiming real identity-plane coverage.

Evidence

What can be inspected.

  • The documented private-lab run produces nineteen local events and verifies eight alerts across four rules.
  • The range includes repeatable setup, health, detection, investigation, hardening, retest, and release-audit workflows.

Lessons

What carries into the next system.

  • Detection practice becomes more reviewable when event generation, rule logic, investigation evidence, and retest stay in the same controlled workflow.

Selected artifacts

Additional views of the working system.

OWASP Juice Shop challenge scoreboard showing two of 178 challenges solved and filters for vulnerability categories.
The challenge scoreboard records the target state used during the local exercise and organizes vulnerability categories for review.