0.4 Your Lab Environment and Equivalents

Introduction

A lab environment is wherever you run the queries and follow the portal steps the course teaches. This course is built so that you need none: every sub carries runnable query panels against a month of records from Northgate Engineering, and every figure in the text comes from those records. A lab of your own adds something different, the real consoles and your own data, and each way of building one has costs, clocks and gaps that are easy to discover too late. This sub sets out the four paths, the in-page records, a Microsoft trial lab, Splunk Free and Elastic, with what each gives and what it cannot do. The vendor terms here were checked against each vendor's own pages on 27 September 2026, and they change, so the sub says when to check them again. By the end you'll know where you will practice, what it will cost, and which modules to reach before starting any clock.

The course supports four places to practice, and they differ in what data they carry, what they cost and how long they last:

The first path is already in front of you. Every sub in the course has query panels that run against Northgate's records in the page, with a Defender KQL tab and a Splunk SPL tab. Nothing needs installing, nothing expires, and every number in the course can be checked by running the query beside it.

The other three add things the in-page records cannot. A Microsoft trial lab gives the real Defender and Entra portals, where the portal callouts in each module happen. Splunk Free and Elastic give a search engine you can load your own data into, which is useful if your workplace uses one of them. What none of them gives is a month of an attacked company's records, because building that takes the kind of work that went into the course's own data.

The four also differ in what they teach. The in-page records teach reading evidence, which is most of triage. A Microsoft lab teaches the consoles, where the containment and escalation steps happen. Splunk and Elastic teach the query language and ingestion of a different platform. A student who does all three leaves with the method and the tools; one who does only the first leaves with the method, which is what the course is for.

The honest recommendation, then, is the order the diagram reads in, left to right: start with the in-page records, and add a lab when a module's portal steps or your own work call for it. A lab built on the first day runs out of trial before the modules that most need it.

What the first path holds is worth seeing before choosing anything else. The course's records are a month of activity at Northgate, from 13 February to 15 March, with several attacks running through it. The main tables behind the runnable panels, by domain:

union
    (SigninLogs | summarize Rows = count()
        | extend Table = "SigninLogs", Domain = "identity"),
    (AADNonInteractiveUserSignInLogs | summarize Rows = count()
        | extend Table = "AADNonInteractiveUserSignInLogs", Domain = "identity"),
    (AuditLogs | summarize Rows = count()
        | extend Table = "AuditLogs", Domain = "identity"),
    (DeviceProcessEvents | summarize Rows = count()
        | extend Table = "DeviceProcessEvents", Domain = "endpoint"),
    (DeviceNetworkEvents | summarize Rows = count()
        | extend Table = "DeviceNetworkEvents", Domain = "endpoint"),
    (EmailEvents | summarize Rows = count()
        | extend Table = "EmailEvents", Domain = "email and cloud"),
    (OfficeActivity | summarize Rows = count()
        | extend Table = "OfficeActivity", Domain = "email and cloud"),
    (CommonSecurityLog | summarize Rows = count()
        | extend Table = "CommonSecurityLog", Domain = "network"),
    (Syslog | summarize Rows = count() | extend Table = "Syslog", Domain = "Linux")
// the main tables behind the course's runnable panels, by domain
| order by Domain asc, Rows desc

| tstats count as Rows where index=* by sourcetype
| sort sourcetype

Nine rows, one per table. Identity is the largest domain, with over 8,000 interactive sign-ins, over 13,000 non-interactive ones and 532 directory audit records. Endpoint carries process, network and file events from Defender for Endpoint; email and cloud carry over 15,000 message records and over 16,000 Microsoft 365 activity records; the network domain holds 2,095 firewall records, and eight Linux servers contribute over 5,000 syslog entries. The full corpus has more tables than these, 54 in all, covering alerts, risk events, device inventory and more.

The rest of this sub goes through each path in turn, and ends with the plan the forum student should have posted.

The records are synthetic, built for the course, and they behave like the real tables they are named after: the same columns, the same kinds of values, and the same gaps a real estate has. A sensor that recorded little on one server records little here too; a sign-in with no device details has none here either. That realism is deliberate, because much of triage is reading what the records do not say, and records without gaps would teach the wrong habit.

The panels behave like a real SIEM for the queries the course uses. A query typed into a panel runs against those tables and returns rows, and the course's rule is that every query shown returns rows, so an empty result means the query was changed, not that the data is missing. A first query worth running in any environment:

SigninLogs
// a first query to run in any lab: the latest sign-ins, with outcome and method
| where UserPrincipalName == "c.richardson@ne.com"
| where TimeGenerated between (datetime("2026-02-27T18:00:00Z")
    .. datetime("2026-02-27T19:30:00Z"))
| project TimeGenerated, IPAddress, Location, AppDisplayName, ResultType,
    AuthenticationRequirement

sourcetype="azure:monitor:aad" category="SignInLogs" user="c.richardson@ne.com"
    earliest="02/27/2026:18:00:00" latest="02/27/2026:19:30:00"
| table _time, src_ip, src_country, app, signature_id, mfa

Connect-MgGraph -Scopes "AuditLog.Read.All"
$filter = "userPrincipalName eq 'c.richardson@ne.com' and " +
    "createdDateTime ge 2026-02-27T18:00:00Z and " +
    "createdDateTime le 2026-02-27T19:30:00Z"
Get-MgAuditLogSignIn -Filter $filter -All |
    Select-Object CreatedDateTime, IpAddress, AppDisplayName,
        AuthenticationRequirement,
        @{ n = "Country"; e = { $_.Location.CountryOrRegion } },
        @{ n = "ErrorCode"; e = { $_.Status.ErrorCode } }

Two rows: c.richardson's own sign-in from the office address at 18:46 on 27 February, and one a minute later from the phishing address, which Modules 5 and 6 examine. The same query, pointed at a lab's own tables, is the first thing to run there as well: it shows whether sign-in data is arriving at all.

The panels also have limits that are worth knowing before relying on them. They run the query language the course teaches and the operators it uses, not every function a production SIEM offers, and a query copied from elsewhere may need adjusting to run. Where a panel's engine cannot run the SPL version of a query, the SPL tab says so and shows the query as a plain example to take to a real Splunk.

What the in-page records cannot do is change. You cannot create a user, trigger an alert or isolate a device in them, and some of the course's steps happen in a console rather than a query. For those, the course gives portal callouts that describe the step exactly, and a lab lets you perform it.

Most students will do most of the course here, in the page, without ever building anything. The records hold every attack the course follows, from the phishing on 27 February to the capstone on 14 March, and the queries in each sub are written to run against them unchanged. A student who never builds a lab still sees every piece of evidence the course discusses, and can check every number in it.

A Microsoft lab gives the real portals that the course's callouts refer to, : Defender XDR, Entra ID and Microsoft Sentinel. Built from trials, it has three clocks, and the vendor terms, checked on 27 September 2026, set them. A Microsoft 365 E5 trial lasts one month, includes 25 licenses, needs a card, and converts to a paid subscription unless canceled. An Azure free account gives $200 of credit to use within 30 days. Microsoft Sentinel waives the first 10 GB a day of ingestion for 31 days on a new workspace, with a limit of 20 trial workspaces per tenant; there is no standing free tier after that.

The E5 trial matters for more than the portals. Sending Entra sign-in logs to a SIEM requires an Entra ID P1 or P2 license, which the E5 trial includes; a free Entra tenant can view its own sign-in logs but cannot export them. The forum plan's first step fails on exactly this: a free tenant cannot send sign-ins to Sentinel at all, and sign-ins are the evidence Modules 5 and 6 are built on.

The audit side is different, and it shows what a trial lab can and cannot recreate:

AuditLogs
// the directory's audit records: how many, how many kinds, over what span
| summarize Records = count(), Operations = dcount(OperationName),
    First = min(TimeGenerated), Last = max(TimeGenerated)

sourcetype="azure:monitor:aad" category="AuditLogs"
| stats count as Records, dc(action) as Operations, min(_time) as First,
    max(_time) as Last

One row: 532 directory audit records at Northgate over the month, across 28 kinds of operation. A trial tenant produces audit records too, for every change you make in it, and those can be exported on any edition. What it will not produce by itself is attacker activity, because nobody is attacking it. A trial lab records what you and your test users do; the Northgate records hold what an attacker did.

That difference sets what a trial lab is for. It is the place to perform the portal steps the course describes: revoking a session, resetting a password, disabling an application, isolating a device, exporting a sign-in log. It is not the place to find an attack, because there is none unless you stage one, and staging one convincingly is harder than the triage it would let you practice.

A trial lab is where mistakes are cheap. Revoking a test user's sessions, resetting a password on both sides of a synced account, or disabling an application with a grant are all steps that go wrong in production when first attempted under pressure. Doing each once in a trial tenant, with nothing at stake, is the best preparation the course can offer for the day they are done for real.

Two more changes are worth knowing. Sentinel's Azure portal experience is being retired on 31 March 2027, and Sentinel continues in the Defender portal, which is why every portal path in this course targets the Defender portal. And the free E5 developer sandbox that older guides describe is not generally available, so the paid trial is the path most students have.

Splunk and Elastic matter because many organizations run one of them instead of, or alongside, Sentinel, and an analyst who moves between employers will meet all three. Every query in this course has a Splunk SPL tab for that reason. Both can be run at no cost, with limits that decide what they are good for.

Splunk Enterprise installs with a 60-day Enterprise Trial license and can then convert to the perpetual Free license. Free allows 500 MB of indexing a day on a single standalone instance, removes authentication and user accounts, and stops searching after three license warnings in a rolling 30 days. When a trial is switched to Free, any alerts defined no longer trigger. Splunk Cloud Platform's trial is 14 days.

That makes Splunk Free a good place to practice searches and a poor place to practice alerting, and worth knowing before building rules that will never run. The forum plan's third step, alerts for the password spray, cannot work on it:

Splunk Free: alert on 10+ failed sign-ins
from one address in 15 minutes.

Splunk Free: run the spray search by hand
on the day's sign-in export.

The right-hand version practices the part of the work triage actually does with a search engine. Its other limits matter less here. A single instance with no users is fine for one student, and 500 MB a day is far more than a trial tenant's sign-ins and audit records produce. The three-warning rule is the one to watch: loading a large export in one go can exceed the daily limit, and repeated overages stop searching until the window clears.

The course does not depend on lab alerts: the alerts you triage come from the Northgate records or from your own estate, and Splunk Free is where you practice the searches that triage them.

Elastic offers a 14-day Elastic Cloud trial with no card, covering one hosted deployment and three Serverless projects, and a self-managed install that runs on a Basic license that does not expire, with a 30-day trial of the paid features. For a student whose workplace uses Elastic Security, the self-managed route is the one that lasts beyond the course; the cloud trial suits a short, focused test.

Neither path comes with data. Each is a search engine waiting for logs, and the most useful logs to load are ones you already have access to: exports from your own trial tenant, or records from your workplace that you are allowed to use. The course's SPL tabs show the searches; your data is what makes them yours.

For both engines, loading the day's sign-in export from a trial tenant is a good first exercise. It exercises the ingestion that real SIEM work depends on, and it gives the SPL tabs something to run against that is not Northgate. The search results will be small and ordinary, which is the point: triage mostly reads ordinary records, looking for the few that are not.

The four paths are not really alternatives so much as layers that build on one another, and a student's choice turns on two questions: which tools they use or expect to use at work, and which modules they are about to reach. Set side by side:

The first path is the course's foundation, and every student uses it, whatever else they add. The second is worth adding for anyone who works in a Microsoft environment, because the portal steps are real skills and the callouts only describe them. The third and fourth suit students whose organization runs Splunk or Elastic, for practicing the SPL tabs against their own data.

The Northgate records also stay useful after a lab is built. A query that returns rows here and nothing in a trial tenant usually means the tenant has no such activity yet, not that the query is wrong; running it here first confirms the query before blaming the lab. Many students keep both open side by side for exactly that reason.

Cost is the other half of the choice. The in-page records and Splunk Free cost nothing; the Azure free account and Elastic's cloud trial cost nothing within their limits; the E5 trial and Sentinel cost nothing within their trial periods but need a card and billing that someone must remember to stop. Section 0.5 prices each step and names the one that is easiest to forget.

Timing matters most for the Microsoft path. Its clocks run from the day each trial starts, so a lab started while reading Module 0 may have expired by the time the student reaches Module 5, where sign-in logs and Conditional Access matter most. The modules that use the Microsoft portals most are 5 and 6, on accounts, sessions, mailboxes and applications; 7 and 9, on endpoint isolation and containment; and 10, on exports and handoff. A student who plans one 30-day window around Modules 5 to 7 gets more from the consoles than one who spreads a single trial thin. The better plan starts the Microsoft trials when the modules that use them come up, and keeps the in-page records for everything before and after.

The vendor terms themselves are the other thing to recheck. Trials change length, free tiers appear and disappear, and portals move. Every term in this sub carries the date it was checked, and Section 0.5 carries the same dates; before starting a trial, the vendor's own page is the authority. A trial that has changed length or a free tier that has appeared is good news, and a student who finds one should use it; the course's recommendation is about the order of work, not a particular vendor offer.

The forum plan was built from sources that were once right. Read it beside the vendor terms as they stand, and make the call:

The call replaces the plan with one that works, step for step, at no cost as long as the trials are stopped on time. Start with the in-page records, which carry every table the course uses and never expire. When the course reaches the modules whose steps happen in the Microsoft portals, start an E5 trial, which carries the Entra P2 needed to export sign-ins, and a Sentinel workspace on its 31-day trial, and plan the work around those clocks. If your workplace runs Splunk or Elastic, add Splunk Free or a self-managed Elastic install for search practice, knowing Splunk Free will not fire alerts.

The revised plan also costs less. The in-page records cost nothing; the E5 trial and Sentinel cost nothing if started when needed and stopped on time; Splunk Free costs nothing at all. The only expense is the one a forgotten trial turns into, which Section 0.5 shows how to avoid.

The student's instinct that real labs are better is half right. A real console teaches the portal steps in a way no description can, and running the course's queries against your own data teaches something the in-page records cannot. But a lab without an attacker in it teaches the tools, not the triage, and the in-page records are where the attacker is.

The steps fit a card for anyone setting up to practice:

The fifth row is the one that ages this sub fastest. The terms above were right on 27 September 2026; the vendor's page is right on the day you read it.

Practice

Set up your practice environment before you need it, and in the order the modules call for it.

If step three finds terms different from this sub's, trust the vendor's page and follow its dates.

Section 0.5 builds the Microsoft and Splunk labs step by step, with what each step costs.