Entry 004
Building a threat hunting lab you will actually use
A containerised lab fed with real telemetry rather than synthetic logs, and why the ingestion decisions made first determine which hunts are possible.
The usual failure
Most home labs generate logs nobody would ever hunt through, because the data was produced to fill a dashboard rather than to answer a question.
Start from the question
Pick one hunt. Work backwards to the fields it needs. Collect those, and only those, until the hunt runs end to end.
Containers, not VMs
The point of the lab is to be rebuilt often. Anything that takes an afternoon to restore will quietly stop being rebuilt.