Split out of #101.
ADR-0007 gives Saruman "a small Windows domain, realistic endpoints" as the
thing the rest of the estate exists to defend and instrument. It is the
component every other one is pointed at: Wazuh has nothing to read without it,
Velociraptor has nothing to hunt on, and
ADR-0014's
whole placement argument is that the techniques worth detecting — LLMNR and
NBNS poisoning, ARP spoofing, rogue DHCP, mitm6, WPAD — are layer 2 and only
reach a domain sharing their broadcast domain.
So this is the load-bearing piece of #101, and the one with the least written
down about it.
Worth deciding before starting
- How small is small. A DC and two endpoints is enough to poison; it is not
enough to have realistic authentication traffic, tiered admin, or anything to
laterally move toward. The right answer is bounded by spindles, not by
taste — see below.
- Licensing and where the media comes from. Evaluation media expires, and
an estate that has to be rebuilt every 180 days is one that will not be
rebuilt.
- Guests take addresses on VLAN 30. The pool is
.100–.200, statics live
below .100, and Saruman at .110 is already the estate's one in-pool
static. Domain members taking leases is fine; the DC is not a lease.
- Time. Kerberos fails domain-wide five minutes after the DC drifts, and
ADR-0014 records that as the specific quiet failure a port allowlist would
have caused. Whatever the DC syncs from, it is worth writing down.
- It is not in scope for backups here. Whether this is snapshot-and-revert
like ifrit's range (ADR-0017) or a defended asset that PBS protects is a
real question and belongs with the PBS issue.
The constraint
ADR-0007: "128 GB and 48 threads against a single mirrored pair of 7.2K disks.
The fleet is sized against spindles, not RAM." A domain controller, endpoints,
Wazuh's indexer, Velociraptor, PBS and the lab observability stack all land on
the same two spindles. Nothing else in #101 is likely to be what runs out.
Split out of #101.
ADR-0007 gives
Saruman"a small Windows domain, realistic endpoints" as thething the rest of the estate exists to defend and instrument. It is the
component every other one is pointed at: Wazuh has nothing to read without it,
Velociraptor has nothing to hunt on, and
ADR-0014's
whole placement argument is that the techniques worth detecting — LLMNR and
NBNS poisoning, ARP spoofing, rogue DHCP, mitm6, WPAD — are layer 2 and only
reach a domain sharing their broadcast domain.
So this is the load-bearing piece of #101, and the one with the least written
down about it.
Worth deciding before starting
enough to have realistic authentication traffic, tiered admin, or anything to
laterally move toward. The right answer is bounded by spindles, not by
taste — see below.
an estate that has to be rebuilt every 180 days is one that will not be
rebuilt.
.100–.200, statics livebelow
.100, andSarumanat.110is already the estate's one in-poolstatic. Domain members taking leases is fine; the DC is not a lease.
ADR-0014 records that as the specific quiet failure a port allowlist would
have caused. Whatever the DC syncs from, it is worth writing down.
like
ifrit's range (ADR-0017) or a defended asset that PBS protects is areal question and belongs with the PBS issue.
The constraint
ADR-0007: "128 GB and 48 threads against a single mirrored pair of 7.2K disks.
The fleet is sized against spindles, not RAM." A domain controller, endpoints,
Wazuh's indexer, Velociraptor, PBS and the lab observability stack all land on
the same two spindles. Nothing else in #101 is likely to be what runs out.