Stop building labs by hand. Automate the deployment of a fully instrumented Purple Team range using Ludus and Elastic Security. Spin up infrastructure, execute attacks, and validate detection rules in a single, repeatable workflow.

**Introduction: The Need for a Scalable, Automated Simulation Range**

**The Solution Architecture: Ludus + Elastic**

**Component 1: The Foundation (Ludus)**

**Component 2: The Targets (The Labs)**

Important Disclaimer

**Component 3: The Sensor Grid (Elastic Agent & Defend)**

**Component 4: The Brain (Elastic Cloud Hosted / Elastic Serverless)**

**Phase 1: Building and Instrumenting the Range**

**3.1 Configuring the Elastic Agent Policy (in Kibana)**

**3.2 The Ludus YAML Configuration (ludus.yml)**

Automating Elastic Agent Deployment

**Safety First: Isolation, OPSEC, and Live Malware**

**4.1 The Threat: This is Not a Simulation**

**4.2 The Contradiction: Isolation vs. Cloud Connectivity**

**4.3 The Solution: Pinhole Egress via Ludus Testing mode**

**4.4 Accessing the Range in Testing Mode (WireGuard)**

**Phase 2: Executing the Attacks**

**5.1 Active Directory Simulation (GOAD)**

**5.2 Malware Lab Simulation (XZbot)**

**Phase 3: Unified Detection & Investigation with Elastic Security**

**6.1 The "Powerful SIEM": Centralized Visibility & Prebuilt Detections**

**6.2 Deep Dive: Tracing Process Chains with Event Analyzer**

What are we seeing?

##### The Graphical Canvas (The Process Tree)

The Detail Panel (Forensic Metadata)

The Temporal Dimension (Time Filter)

How does it work?

**6.3 Deep Dive: Reconstructing User Activity with Session Viewer**

The Process Tree and Timeline

Visual Badging and Indicators

*Visual Indicators in Elastic Session Viewer*

Terminal Output View

**The Elastic Advantage: AI-Powered Automated Hunting**

**7.1 From Alerts to Attacks: Automated Correlation with Attack Discovery**

Deconstructing the "Mental Stitching"

Example

**7.2 Accelerating Triage with the AI Assistant**

How It Works 

**7.3 Intelligent Automation with Elastic Workflows**

What are Workflows?

How It Works: The "Alert Aggregator & Workflow Engine"

**Conclusion: From Manual Setup to Continuous Emulation**

**Take the Next Step: Enable Your Security Team**

Using another SIEM?

Appendix

Example Full Range

Cyber Ranges as Code with Ludus and Elastic

Automating GOAD and Live Malware Labs

Author

Adrian Chen

Articles

Automating GOAD and Live Malware Labs