Build a Lab on Ludus
Stand up a complete nano SIEM lab — Active Directory, Windows Sysmon/Event-Log collection, a Vector pipeline, and the open-core stack — on a Ludus cyber range.
Build a Lab on Ludus
Want a realistic, throwaway SIEM lab — a Windows AD domain generating Sysmon and Event Log telemetry, flowing through Vector into a full nano stack? The nano-rs/nano-ludus repo is a set of Ansible roles + a Ludus blueprint that builds exactly that, end-to-end, from the public open-core images.
This lab deploys onto Ludus — it doesn't install Ludus. If you don't have a range yet,
follow the Ludus install guide and confirm ludus range list
works before continuing.
What you get
DC01 (Win2022) ┐
SRV01 (Win2022)┤─ Sysmon + Event Logs ─► Vector agent ─► aggregator ─► SIEM ─► ClickHouse
WS01 (Win11) ┘ (:9000) (.10.11) (.10.10)- An
lab.localActive Directory domain (1 DC, 1 member server, 1 workstation) - Sysmon (SwiftOnSecurity config) + Windows Event Logs collected by Vector agents
- A Vector aggregator + optional Conduit MITM proxy on a proxy box
- The full nano stack (ClickHouse, PostgreSQL, API/search/jobs, web, nginx) on the SIEM box
Quick start
Every VM is named <RANGE>-<host>, where <RANGE> is your Ludus range ID (shown by
ludus range list). Substitute your own throughout — don't copy a literal prefix from
these docs.
Build the templates. The blueprint needs debian-12-x64-server-template,
win2022-server-x64-template, and win11-22h2-x64-enterprise-template:
ludus templates list
ludus templates build -n win11-22h2-x64-enterprise-template # repeat per missing templateThe Windows templates take 1–2 hr each and occasionally fail on the Windows-update/sysprep
step. If one errors, just re-run ludus templates build -n <name> — a manual retry almost
always succeeds. Don't deploy until all three show built.
Add the roles (clone the repo first):
git clone https://github.com/nano-rs/nano-ludus && cd nano-ludus
ludus ansible role add geerlingguy.docker
ludus ansible role add -d roles/nano_stack
ludus ansible role add -d roles/nano_sysmon
ludus ansible role add -d roles/nano_vector_aggregator
ludus ansible role add -d roles/nano_vector_agent
ludus ansible role add -d roles/nano_conduit_proxyludus range deploy runs the copy of each role cached on the Ludus server, not your
local files. After editing a role you must re-push it with
ludus ansible role add -d roles/<role> --force, or the deploy keeps running the old one.
Deploy:
ludus range config set -f blueprint.yml
ludus range deploy
ludus range logs -fFirst boot provisions the VMs, builds the AD domain, pulls images, and runs first-boot
ClickHouse migrations. A clean run ends with every host at failed=0.
Access over the Ludus WireGuard VPN. The whole app is served through nginx on
port 80 — open http://10.<octet>.10.10 and you'll be redirected to /setup to
create the admin account. (<octet> is your range's second octet.)
Windows events flow in immediately as raw message + source_type
(windows_event / windows_sysmon). Deploy the matching parsers from the in-app Parser
Repository to extract structured fields.
Troubleshooting
A few Windows-side gotchas are worth knowing — the roles handle most automatically. The big one:
This is a Ludus base-config reboot/WinRM race (not a nano role), most often on the
Win11 workstation. Retry the box — ludus range deploy --limit <RANGE>-ws01 — or run
just the role stage, which skips the base reboot:
ludus range deploy -t user-defined-roles --limit <RANGE>-ws01.
The repo's README has the full list — the Windows temp-strip workaround, lab-DNS pull throttling, HTTP-vs-HTTPS notes, and more.
nano-investigator MCP
Turn Claude Code (or any MCP client) into a SOC analyst workstation with @nano-rs/investigator-mcp-server — search, triage, investigate, and hunt in natural language
Performance & Benchmarks
How nano search performs on real IR/SOC investigations — measured under live production load, with the queries, latencies, and the concurrency knee.