Partnership nano × Ludus

Build the range. Watch every move.

nano ships as a Ludus source. Add it to any range and ludus range deploy stands up the lab already wired for telemetry — Vector agents on every endpoint, a Conduit system proxy on the wire, all landing in nano's open-core SIEM.

See how it deploys Read the source docs Visit Ludus

sysmon[1] process.create lab-win11 14:59:23 4624 logon ACME\jsmith ✓ conduit CONNECT update.acme.lab:443 14:59:21 4688 cmd.exe sev=med vector.agent → nano sysmon[3] net.connect 10.2.7.14 sysmon[1] process.create lab-win11 14:59:23 4624 logon ACME\jsmith ✓ conduit CONNECT update.acme.lab:443 14:59:21 4688 cmd.exe sev=med vector.agent → nano sysmon[3] net.connect 10.2.7.14

eventlog.Security rows=9,204 14:57:02 4769 TGS-REQ rc4 susp conduit.http GET /payload.exe 200 14:56:40 7045 service.install srv-dc01 aggregator | route | ship 14:55:13 4672 admin.logon srv-dc01 eventlog.Security rows=9,204 14:57:02 4769 TGS-REQ rc4 susp conduit.http GET /payload.exe 200 14:56:40 7045 service.install srv-dc01 aggregator | route | ship 14:55:13 4672 admin.logon srv-dc01

conduit.tls sni=cdn.acme.lab 14:54:55 4625 logon.fail admin ✗ sysmon[10] proc.access lsass.exe range vlan=10.2.0.0/16 inserted block rows=4,096 pivt: lateral movement? conduit.tls sni=cdn.acme.lab 14:54:55 4625 logon.fail admin ✗ sysmon[10] proc.access lsass.exe range vlan=10.2.0.0/16 inserted block rows=4,096 pivt: lateral movement?

LIVE · range telemetry → nano

Spin up a cyber range in Ludus and get a working SIEM on top of it — every endpoint and every proxied session streaming into nano.

 Vector agents· Conduit MITM proxy· ClickHouse + Postgres· self-hosted 

fig 01 — A Ludus range, fully instrumented and streaming to nano.

Why together

Two halves of one range.

Ludus owns the lab — provisioning, blueprints, isolation, snapshots. nano owns the visibility — collection, storage, search, detection, investigation. The nano source is what joins them: one ludus range deploy and the range comes up already watching itself.

· the range

Stand up the lab.

01One static binary on Proxmox — open source, fully documented.

02Realistic AD enterprises — Win 11, Windows Servers, a DC — in minutes.

03Define it in a blueprint; scale to whatever the engagement needs.

04Isolated per range. Snapshot, reset, redeploy at will.

nano source

· the visibility

See everything it does.

01Vector agents collect Sysmon & EventLog from every endpoint.

02A Conduit system proxy logs every HTTP/S session on the wire.

03It all lands in nano's open core — ClickHouse + Postgres.

04Search, run detections, and let pivt drive the investigation.

Setup flow

From source to live telemetry.

Add the nano source, pick a blueprint, deploy. Ludus provisions the VMs and runs the roles; the nano source installs the agents, attaches the proxy, and brings the SIEM up — no extra wiring.

01 · Add source

source

ludus source add nano-rs/nano-ludus blueprints · roles

02 · Blueprint

debian · proxy + SIEM windows 11 windows server ×2 + scale freely

03 · Deploy

ludus range deploy ▸ provision VMs ▸ install Vector agents ▸ attach Conduit proxy

04 · nano live

SIEM · self-hosted

clickhouse + postgres search · detections ▸ telemetry live

fig 02 — From source add to live telemetry in four steps.

The deployed range

One box runs the watch.

Out of the box the blueprint lays down a Debian host that carries the Conduit proxy, the Vector aggregator, and the nano stack — and a handful of Windows targets that route through it. Every box is one VM in your range; add or remove them freely.

range · isolated vlan 10.2.0.0/16

Windows 11

workstation · 10.2.7.14

vector agent · sysmon

Win Server · DC

srv-dc01 · 10.2.10.5

vector agent · eventlog

Win Server · App

srv-app02 · 10.2.10.8

vector agent · sysmon

logs + proxied traffic ↓

Debian 12 · gateway + SIEM host 10.2.0.2

single VM

Conduit

system proxy

MITM · TLS intercept
logs every session

Vector

aggregator

collects agents
routes & ships

SIEM

clickhouse + postgres

store · search
detect · investigate

fig 03 — The default blueprint: one Debian box runs the proxy, the aggregator, and nano.

The Conduit proxy

Nothing leaves the range unseen.

Conduit is a full system proxy. Endpoints are configured to route through it, so every request — plaintext or TLS — is intercepted, logged, and shipped to nano alongside the host telemetry. Beacon check-ins, tool downloads, exfil attempts: all on the record.

endpoint

system proxy
10.2.0.2:8080

intercept

Conduit

decrypt · log
re-encrypt · fwd

› CONNECT update.acme.lab:443 via conduit

› tls intercept · sni=update.acme.lab logged

› GET /payload.exe · 1.8 MB · flagged

› ship conduit.http ▸ nano

Full system proxy

Every endpoint routes through Conduit, so coverage isn't per-app — it's the whole box.

TLS intercept

With the range CA trusted, HTTPS is decrypted, recorded, and re-encrypted on the way out.

Correlated in nano

Proxy logs land beside Sysmon and EventLog, so a process and its network is one query.

Optional, per blueprint

Turn the proxy on or off in the blueprint — host telemetry keeps flowing either way.

fig 04 — Conduit sits inline as the range's system proxy; every session is logged.

Purple in one box

Run the attack. Watch it land.

Because the range watches itself, the feedback loop is immediate. Fire a technique on the red side and the telemetry shows up in nano on the blue side — ready to tune a detection or practice an investigation.

Red — action

Kerberoast

Rubeus.exe kerberoast
/outfile:hashes.txt

Range — telemetry

4769 TGS-REQ enc=rc4 sysmon[1] Rubeus.exe sysmon[10] proc.access lsass vector.agent ▸ srv-dc01

Blue — in nano

detection fires

▸ Kerberoasting high
pivt: 3 next pivots →

fig 05 — Run an attack, watch the telemetry land — and write the detection.

In practice

A source, two commands.

Point Ludus at the nano source repo, then deploy. The source.yml is just metadata — the blueprints, roles, and collections do the work.

$ ludus source add nano-rs/nano-ludus $ ludus range deploy

Browse the blueprint reference

source.yml

# source.yml: repo-level metadata. The whole file is optional.
# When absent, Ludus derives name from the URL and homepage
# from the git remote.

manifest_version: 1                # schema version, leave as 1
name: "nano SIEM"                # display name in source list
description: "Active Directory lab with Windows
  Sysmon/EventLog collection shipped via Vector agent
  to a Vector aggregator and into the nano open-core
  SIEM stack (ClickHouse + Postgres), plus an optional
  Conduit MITM proxy."
authors:
  - "nano-rs <https://nano.rs>"
homepage: https://github.com/nano-rs/nano-ludus
license: Apache-2.0                # SPDX identifier

What you get

A range that teaches you.

01 · Red & purple

Ground truth for every technique.

Run an attack and see exactly what it generates — host events and proxied traffic, correlated. Tune detections against real signal, not guesswork.

02 · Blue team

Learn nano on a live SIEM.

A safe, disposable environment to get fluent in search, detections, and pivt-driven investigations — with data you generated yourself.

03 · Control

Open core, self-hosted.

Ludus and nano both run on your own hardware. No cloud dependency, no per-seat tax — snapshot, reset, and redeploy as often as you like.

Add the source. Deploy the range.

Stand up a cyber range that watches itself — Vector agents, a Conduit proxy, and nano, in one range deploy. Self-hosted, open core, yours to break.

Get the nano source Try nano cloud

Visit Ludus · ludus.cloud

Ludus 2.2+ · Proxmox · Vector agents · Conduit proxy optional · ClickHouse + Postgres