Before you start: what you should already know, and building your security lab on AWS step by step

cd ~/Downloads/lesson-before/lab

aws --version

aws-cli/2.36.26 Python/3.14.6 Darwin/24.6.0 exe/arm64

session-manager-plugin --version

1.2.896.0

python3 --version

Python 3.13.15

uv --version

uv 0.12.5 (Homebrew 2026-08-14 aarch64-apple-darwin)

git --version

git version 2.39.5 (Apple Git-154)

code --version

1.146.0
69047191fc427f2f92828279aae1d90d8eeda7ab
arm64

python3 check_setup.py

OK   Python 3.13.15 (need 3.10 or newer)
OK   AWS CLI: aws-cli/2.36.26
OK   the AWS CLI can sign in to your account, as user/admin
OK   region us-east-1
OK   Session Manager plugin is installed
OK   local port 8443 is free (the Wazuh dashboard, through the tunnel)
OK   local port 9200 is free (the Wazuh indexer, through the tunnel)

7 of 7 checks passed

./lab.sh quota

your limit for standard EC2 machines in us-east-1: 1 vCPUs
the lab needs 12 vCPUs, or 14 with Windows
not enough yet. Ask AWS to raise it to 16, then wait for the email that says it is done:
  aws service-quotas request-service-quota-increase --region us-east-1 --service-code ec2 --quota-code L-1216C47A --desired-value 16

export LAB_OVERRIDES="WazuhType=g5g.xlarge LinuxVictimType=g5g.xlarge KaliType=g5g.xlarge AdminType=g5g.xlarge NatType=t2.micro NatAmi=/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64"

./lab.sh budget you@example.com

budget soc-course-lab: $10 a month, emails at 50% and 100% spent, and when the forecast passes $10

./lab.sh up

Waiting for changeset to be created..
Waiting for stack create/update to complete
Successfully created/updated stack - soc-lab
The machines are starting. Wazuh takes about 10 to 15 more minutes to install: run ./lab.sh ready

a lab called soc-lab already exists. Use ./lab.sh start to wake it up, or ./lab.sh down to delete it first.

./lab.sh status

--------------------------------------------------------------------
|                         DescribeInstances                        |
+--------------------------+-------------+-------------+-----------+
|  soc-lab-nat             |  10.20.0.10 |  t2.micro   |  running  |
|  soc-lab-wazuh-server    |  10.20.1.10 |  g5g.xlarge |  running  |
|  soc-lab-linux-server-01 |  10.20.1.20 |  g5g.xlarge |  running  |
|  soc-lab-admin-pc        |  10.20.1.50 |  g5g.xlarge |  running  |
|  soc-lab-kali-attacker   |  10.20.2.66 |  g5g.xlarge |  running  |
+--------------------------+-------------+-------------+-----------+
------------------------------------------
|       DescribeInstanceInformation      |
+------------------------------+---------+
|  wazuh-server                |  Online |
|  linux-server-01             |  Online |
|  kali                        |  Online |
|  admin-pc                    |  Online |
|  ip-10-20-0-10.ec2.internal  |  Online |
+------------------------------+---------+

./lab.sh ready

waiting for Wazuh to finish installing (it checks every 30 seconds)

Wazuh is installed. The agents that have joined it:
   ID: 000, Name: wazuh-server (server), IP: 127.0.0.1, Active/Local
   ID: 001, Name: linux-server-01, IP: any, Active

./lab.sh tunnel

dashboard: https://localhost:8443   indexer: https://localhost:9200   (press Ctrl+C to close both)
Starting session with SessionId: admin-f9zsnfdj5rso34ria4s7popd9q
Port 8443 opened for sessionId admin-f9zsnfdj5rso34ria4s7popd9q.
Waiting for connections...

./lab.sh password

./lab.sh everyday

1. the administrator logs in from admin-pc (10.20.1.50) with the right password and checks the disk
/dev/root       6.8G  2.4G  4.4G  35% /

2. the administrator mistypes the password once, then gets it right
Permission denied, please try again.

 02:09:45 up 19 min,  1 user,  load average: 0.00, 0.00, 0.00

3. the administrator adds a service account for backups on linux-server-01
added the user backup-svc

./lab.sh kali

hydra -l student -P guesses.txt -t 1 ssh://10.20.1.20
sshpass -p 'Lab-Only-Pass-91' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR student@10.20.1.20 'echo logged in as $(whoami) on $(hostname)'
exit

./lab.sh admin-login

the administrator logs in once more from admin-pc (10.20.1.50) and looks at the home folders
backup-svc
student
ubuntu

./lab.sh stop

./lab.sh start

./lab.sh down

deleting the lab (about 5 to 10 minutes)
the stack is deleted
the stack soc-lab:      deleted
machines still there: none
disks still there:    none
elastic addresses:    none
lab networks:         none
nothing is left: the lab costs nothing now

head -2 auth-sample.log

2026-11-13T02:09:30.318073+00:00 linux-server-01 sshd[6087]: Accepted password for student from 10.20.1.50 port 35648 ssh2
2026-11-13T02:09:30.319483+00:00 linux-server-01 sshd[6087]: pam_unix(sshd:session): session opened for user student(uid=1001) by student(uid=0)

grep -c 'Failed password' auth-sample.log

5

"""The self-check: count failed and successful SSH logins per address in a real login log.

From the page "Before you start". auth-sample.log holds 60 real lines from the
login log of our cloud lab's practice server on 13 November 2026. If you can
read this program and say what it will print before you run it, your Python is
ready for the course. Needs only Python 3.10 or newer: no packages.

    python3 count_failures.py

Author: Roni Das
Created: 2026-11-13
"""

from collections import Counter
from pathlib import Path

LOG = Path(__file__).with_name("auth-sample.log")


def address(line: str) -> str:
    """The word after "from" in an sshd line is the address the login came from."""
    words = line.split()
    return words[words.index("from") + 1]


def times(line: str) -> int:
    """The log writes "message repeated 5 times: [ ... ]" instead of five identical lines."""
    if "message repeated" in line:
        return int(line.split("message repeated ")[1].split()[0])
    return 1


failed, accepted = Counter(), Counter()
for line in LOG.read_text(encoding="utf-8").splitlines():
    if "Failed password" in line:
        failed[address(line)] += times(line)
    elif "Accepted password" in line:
        accepted[address(line)] += 1

print("address        failed  accepted")
for ip in sorted(set(failed) | set(accepted)):
    print(f"{ip:<14} {failed[ip]:>6}  {accepted[ip]:>8}")

address        failed  accepted
10.20.1.50          1         3
10.20.2.66         11         1

"""Check that this computer is ready to build and use the course lab on AWS, and print what it found.

From the page "Before you start". It reads six things and changes nothing:
the Python version, the AWS CLI, whether the AWS CLI can sign in to your
account, the region it will use, the Session Manager plugin, and whether the
two local ports the lab's tunnel uses are free. Needs only Python 3.10 or
newer: no packages. It never prints your account number or your keys.

    python3 check_setup.py

Author: Roni Das
Created: 2026-11-13
"""

from __future__ import annotations  # so that an older Python reaches the version check below

import json
import os
import shutil
import socket
import subprocess
import sys

TUNNEL_PORTS = {8443: "the Wazuh dashboard, through the tunnel",
                9200: "the Wazuh indexer, through the tunnel"}


def result(ok: bool, what: str) -> bool:
    print(f"{'OK  ' if ok else 'FIX '} {what}")
    return ok


def run(*command: str) -> subprocess.CompletedProcess | None:
    """Run a command and return what it printed, or None if the program is not installed."""
    try:
        return subprocess.run(command, capture_output=True, text=True, timeout=60)
    except (FileNotFoundError, subprocess.TimeoutExpired):
        return None


def port_in_use(port: int) -> bool:
    """True if something on this computer already answers on the port."""
    with socket.socket() as s:
        s.settimeout(0.5)
        return s.connect_ex(("127.0.0.1", port)) == 0


checks = [result(sys.version_info >= (3, 10), f"Python {sys.version.split()[0]} (need 3.10 or newer)")]

cli = run("aws", "--version")
checks.append(result(cli is not None and cli.returncode == 0,
                     f"AWS CLI: {cli.stdout.split()[0]}" if cli and cli.stdout else
                     "AWS CLI is not installed: see the install step on this page"))

who = run("aws", "sts", "get-caller-identity", "--output", "json")
if who is not None and who.returncode == 0:
    name = json.loads(who.stdout)["Arn"].split(":")[-1]  # the user or role name, never the account number
    checks.append(result(True, f"the AWS CLI can sign in to your account, as {name}"))
else:
    checks.append(result(False, "the AWS CLI cannot sign in: run aws configure, then try again"))

region = run("aws", "configure", "get", "region")
name = os.environ.get("AWS_REGION") or (region.stdout.strip() if region else "")
checks.append(result(bool(name), f"region {name}" if name else "no region set: run aws configure set region us-east-1"))

plugin = shutil.which("session-manager-plugin")
checks.append(result(plugin is not None, "Session Manager plugin is installed" if plugin else
                     "Session Manager plugin is missing: see the install step on this page"))

for port, use in TUNNEL_PORTS.items():
    busy = port_in_use(port)
    checks.append(result(not busy, f"local port {port} is {'already in use' if busy else 'free'} ({use})"))
print(f"\n{sum(checks)} of {len(checks)} checks passed")

#!/usr/bin/env bash
# The AI SOC Analyst course lab on AWS: build it, use it, and remove it, one command at a time.
#
#   ./lab.sh quota                    check that your account may run the lab's 12 vCPUs (14 with Windows)
#   ./lab.sh budget you@example.com   a monthly $10 cost budget that emails you at 50% and 100%. Run this first.
#   ./lab.sh up                       build the lab from soc-lab.yaml (about 15 minutes until Wazuh is ready)
#   ./lab.sh up-windows               the same, with the Windows Server and Sysmon added (only on a lab that does not exist yet)
#   ./lab.sh status                   each machine, its private address, and whether Session Manager can reach it
#   ./lab.sh ready                    wait until Wazuh is installed, then list the agents that have joined it
#   ./lab.sh password                 print the Wazuh admin password (for the dashboard and the indexer)
#   ./lab.sh tunnel                   reach the dashboard at https://localhost:8443 and the indexer at localhost:9200
#   ./lab.sh kali                     open a Kali Linux shell on the attacker
#   ./lab.sh shell <machine>          open a shell on wazuh, linux, admin or windows
#   ./lab.sh run <machine> "<command>" run one command on a Linux machine and print what it printed
#   ./lab.sh everyday                 play the administrator's ordinary work on the practice server
#   ./lab.sh admin-login              one more ordinary login by the administrator, later in the shift
#   ./lab.sh stop | start             stop the machines between sessions (about 1 cent an hour), and start them again
#   ./lab.sh down                     delete the whole lab, then check that nothing is left
#   ./lab.sh check-gone               list anything still tagged Project=soc-course-lab
#
# Every machine sits in a private subnet. Nothing accepts a connection from the internet, so there is no SSH key
# and no open port: Session Manager reaches each machine from the inside. Attack only these machines.
#
# Author: Roni Das
# Created: 2026-11-13
set -euo pipefail

STACK="${SOC_LAB_STACK:-soc-lab}"
REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-$(aws configure get region 2>/dev/null || true)}}"
REGION="${REGION:-us-east-1}"
export AWS_PAGER=""   # print results straight to the terminal, never into a pager
HERE="$(cd "$(dirname "$0")" && pwd)"
TAG="Project=soc-course-lab"
LAB_PASSWORD="${LAB_PASSWORD:-Lab-Only-Pass-91}"

aws_() { aws --region "$REGION" "$@"; }

output() {   # the instance id the stack recorded for one machine
  aws_ cloudformation describe-stacks --stack-name "$STACK" \
    --query "Stacks[0].Outputs[?OutputKey=='$1'].OutputValue" --output text
}

machine() {  # a short name to an instance id
  case "$1" in
    wazuh) output WazuhServer ;; linux) output LinuxVictim ;; admin) output AdminComputer ;;
    kali) output KaliAttacker ;; windows) output WindowsVictim ;; nat) output NatInstance ;;
    *) echo "unknown machine: $1 (use wazuh, linux, admin, kali or windows)" >&2; exit 2 ;;
  esac
}

run_on() {   # run one shell command on a Linux machine through Session Manager, and print what it printed
  local id="$1" cmd="$2" cid status
  cid=$(aws_ ssm send-command --instance-ids "$id" --document-name AWS-RunShellScript \
        --parameters "$(python3 -c 'import json,sys; print(json.dumps({"commands": [sys.argv[1]]}))' "$cmd")" \
        --query Command.CommandId --output text)
  for _ in $(seq 1 60); do
    sleep 2
    status=$(aws_ ssm get-command-invocation --command-id "$cid" --instance-id "$id" --query Status --output text 2>/dev/null || true)
    case "$status" in Success|Failed|Cancelled|TimedOut) break ;; esac
  done
  aws_ ssm get-command-invocation --command-id "$cid" --instance-id "$id" --query StandardOutputContent --output text
  [ "$status" = "Success" ]
}

deploy() {
  # Building over an existing lab could replace or restart its machines, so the script refuses to.
  if aws_ cloudformation describe-stacks --stack-name "$STACK" >/dev/null 2>&1; then
    echo "a lab called $STACK already exists. Use ./lab.sh start to wake it up, or ./lab.sh down to delete it first." >&2
    exit 1
  fi
  aws_ cloudformation deploy --stack-name "$STACK" --template-file "$HERE/soc-lab.yaml" \
    --capabilities CAPABILITY_IAM --tags "$TAG" \
    --parameter-overrides "IncludeWindows=$1" "LabPassword=$LAB_PASSWORD" ${LAB_OVERRIDES:-}
  echo "The machines are starting. Wazuh takes about 10 to 15 more minutes to install: run ./lab.sh ready"
}

case "${1:-help}" in
  budget)
    email="${2:?say the email address for the alerts: ./lab.sh budget you@example.com}"
    account=$(aws sts get-caller-identity --query Account --output text)
    if aws budgets describe-budget --account-id "$account" --budget-name soc-course-lab >/dev/null 2>&1; then
      echo "the budget soc-course-lab already exists: nothing to do"; exit 0
    fi
    aws budgets create-budget --account-id "$account" \
      --budget '{"BudgetName":"soc-course-lab","BudgetLimit":{"Amount":"10","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
      --notifications-with-subscribers "[
        {\"Notification\":{\"NotificationType\":\"ACTUAL\",\"ComparisonOperator\":\"GREATER_THAN\",\"Threshold\":50,\"ThresholdType\":\"PERCENTAGE\"},\"Subscribers\":[{\"SubscriptionType\":\"EMAIL\",\"Address\":\"$email\"}]},
        {\"Notification\":{\"NotificationType\":\"ACTUAL\",\"ComparisonOperator\":\"GREATER_THAN\",\"Threshold\":100,\"ThresholdType\":\"PERCENTAGE\"},\"Subscribers\":[{\"SubscriptionType\":\"EMAIL\",\"Address\":\"$email\"}]},
        {\"Notification\":{\"NotificationType\":\"FORECASTED\",\"ComparisonOperator\":\"GREATER_THAN\",\"Threshold\":100,\"ThresholdType\":\"PERCENTAGE\"},\"Subscribers\":[{\"SubscriptionType\":\"EMAIL\",\"Address\":\"$email\"}]}]"
    echo "budget soc-course-lab: \$10 a month, emails at 50% and 100% spent, and when the forecast passes \$10"
    ;;
  quota)
    have=$(aws_ service-quotas get-service-quota --service-code ec2 --quota-code L-1216C47A --query Quota.Value --output text)
    echo "your limit for standard EC2 machines in $REGION: ${have%.*} vCPUs"
    echo "the lab needs 12 vCPUs, or 14 with Windows"
    if [ "${have%.*}" -ge 14 ]; then echo "enough: go ahead"
    elif [ "${have%.*}" -ge 12 ]; then echo "enough for the lab without Windows: use ./lab.sh up, not up-windows"; else
      echo "not enough yet. Ask AWS to raise it to 16, then wait for the email that says it is done:"
      echo "  aws service-quotas request-service-quota-increase --region $REGION --service-code ec2 --quota-code L-1216C47A --desired-value 16"
      exit 1; fi
    ;;
  up) deploy false ;;
  up-windows) deploy true ;;
  status)
    aws_ ec2 describe-instances --filters "Name=tag:Project,Values=soc-course-lab" \
      "Name=instance-state-name,Values=pending,running,stopping,stopped" \
      --query 'sort_by(Reservations[].Instances[], &PrivateIpAddress)[].[Tags[?Key==`Name`]|[0].Value, PrivateIpAddress, InstanceType, State.Name]' \
      --output table
    aws_ ssm describe-instance-information --filters "Key=tag:Project,Values=soc-course-lab" \
      --query 'InstanceInformationList[].[ComputerName, PingStatus]' --output table
    ;;
  ready)
    wazuh=$(machine wazuh)
    echo "waiting for Wazuh to finish installing (it checks every 30 seconds)"
    tries=0
    until run_on "$wazuh" "test -f /root/wazuh-ready && echo yes" >/dev/null 2>&1; do
      tries=$((tries + 1))
      if [ "$tries" -ge 80 ]; then
        echo; echo "Wazuh is not ready after 40 minutes. Its install log ends with:" >&2
        run_on "$wazuh" "tail -5 /root/wazuh-install.log" >&2 || true
        exit 1
      fi
      sleep 30; printf "."
    done
    echo
    echo "Wazuh is installed. The agents that have joined it:"
    run_on "$wazuh" "/var/ossec/bin/agent_control -l | grep -E 'ID: 0'"
    ;;
  password) run_on "$(machine wazuh)" "cat /root/admin-password" ;;
  tunnel)
    wazuh=$(machine wazuh)
    echo "dashboard: https://localhost:8443   indexer: https://localhost:9200   (press Ctrl+C to close both)"
    aws_ ssm start-session --target "$wazuh" --document-name AWS-StartPortForwardingSession \
      --parameters '{"portNumber":["9200"],"localPortNumber":["9200"]}' >/dev/null &
    trap 'kill %1 2>/dev/null' EXIT
    aws_ ssm start-session --target "$wazuh" --document-name AWS-StartPortForwardingSession \
      --parameters '{"portNumber":["443"],"localPortNumber":["8443"]}'
    ;;
  kali)
    aws_ ssm start-session --target "$(machine kali)" --document-name AWS-StartInteractiveCommand \
      --parameters '{"command":["sudo kali"]}'
    ;;
  run) run_on "$(machine "${2:?say which machine}")" "${3:?say the command, in quotes}" ;;
  shell) aws_ ssm start-session --target "$(machine "${2:?say which machine: wazuh, linux, admin or windows}")" ;;
  everyday)
    admin=$(machine admin); linux=$(machine linux)
    ssh_cmd="sshpass -p PASS ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o PreferredAuthentications=password -o PubkeyAuthentication=no student@10.20.1.20"
    echo "1. the administrator logs in from admin-pc (10.20.1.50) with the right password and checks the disk"
    run_on "$admin" "${ssh_cmd/PASS/$LAB_PASSWORD} 'df -h / | tail -1'"
    echo "2. the administrator mistypes the password once, then gets it right"
    run_on "$admin" "${ssh_cmd/PASS/${LAB_PASSWORD%?}} true; echo 'Permission denied, please try again.'" || true
    run_on "$admin" "${ssh_cmd/PASS/$LAB_PASSWORD} uptime"
    echo "3. the administrator adds a service account for backups on linux-server-01"
    run_on "$linux" "if id backup-svc >/dev/null 2>&1; then echo 'the user backup-svc already exists'; else useradd -m -s /usr/sbin/nologin backup-svc && echo 'added the user backup-svc'; fi"
    ;;
  admin-login)
    echo "the administrator logs in once more from admin-pc (10.20.1.50) and looks at the home folders"
    run_on "$(machine admin)" "sshpass -p '$LAB_PASSWORD' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o PreferredAuthentications=password -o PubkeyAuthentication=no student@10.20.1.20 'ls /home'"
    ;;
  stop)
    ids=$(aws_ ec2 describe-instances --filters "Name=tag:Project,Values=soc-course-lab" "Name=instance-state-name,Values=running" --query 'Reservations[].Instances[].InstanceId' --output text)
    if [ -z "$ids" ]; then echo "no running lab machines: nothing to stop"; exit 0; fi
    aws_ ec2 stop-instances --instance-ids $ids --query 'StoppingInstances[].InstanceId' --output text
    echo "stopped: you now pay only for the disks, about 1 cent an hour"
    ;;
  start)
    ids=$(aws_ ec2 describe-instances --filters "Name=tag:Project,Values=soc-course-lab" "Name=instance-state-name,Values=stopped" --query 'Reservations[].Instances[].InstanceId' --output text)
    if [ -z "$ids" ]; then echo "no stopped lab machines: nothing to start"; exit 0; fi
    aws_ ec2 start-instances --instance-ids $ids --query 'StartingInstances[].InstanceId' --output text
    echo "starting: Wazuh is ready again a few minutes after this"
    ;;
  down)
    aws_ cloudformation delete-stack --stack-name "$STACK"
    echo "deleting the lab (about 5 to 10 minutes)"
    if aws_ cloudformation wait stack-delete-complete --stack-name "$STACK"; then
      echo "the stack is deleted"
    else
      echo "the delete did not finish cleanly: the check below shows what is left" >&2
    fi
    "$0" check-gone
    ;;
  check-gone)
    left=$(aws_ ec2 describe-instances --filters "Name=tag:Project,Values=soc-course-lab" "Name=instance-state-name,Values=pending,running,stopping,stopped" --query 'Reservations[].Instances[].InstanceId' --output text)
    vols=$(aws_ ec2 describe-volumes --filters "Name=tag:Project,Values=soc-course-lab" --query 'Volumes[].VolumeId' --output text)
    ips=$(aws_ ec2 describe-addresses --filters "Name=tag:Project,Values=soc-course-lab" --query 'Addresses[].PublicIp' --output text)
    vpcs=$(aws_ ec2 describe-vpcs --filters "Name=tag:Project,Values=soc-course-lab" --query 'Vpcs[].VpcId' --output text)
    stack=$(aws_ cloudformation describe-stacks --stack-name "$STACK" --query 'Stacks[0].StackStatus' --output text 2>/dev/null || true)
    echo "the stack $STACK:      ${stack:-deleted}"
    echo "machines still there: ${left:-none}"
    echo "disks still there:    ${vols:-none}"
    echo "elastic addresses:    ${ips:-none}"
    echo "lab networks:         ${vpcs:-none}"
    if [ -z "$left$vols$ips$vpcs$stack" ]; then echo "nothing is left: the lab costs nothing now"; else echo "something is left: run ./lab.sh down again"; exit 1; fi
    ;;
  *) awk 'NR>1 && /^# Every machine/{exit} NR>1' "$0" | sed 's/^# \{0,1\}//' ;;
esac

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  AI SOC Analyst course lab (systemdesign.academy). One VPC with private subnets: a Wazuh 4.14 all-in-one
  server, an Ubuntu practice server, an administrator's computer, a Kali Linux attacker and, if you ask for it,
  a Windows Server with Sysmon. Nothing accepts connections from the internet. You reach every machine through
  AWS Systems Manager Session Manager. This is your own lab: attack only these machines.

Parameters:
  IncludeWindows:
    Type: String
    AllowedValues: ["true", "false"]
    Default: "false"
    Description: Add the Windows Server 2022 practice server with Sysmon (about $0.063 an hour more).
  LabPassword:
    Type: String
    NoEcho: true
    Default: Lab-Only-Pass-91
    MinLength: 8
    Description: The weak password of the user "student" on the practice server. The attack in the course guesses it.
  # The machine sizes. The defaults are the cheapest types that meet each machine's needs in us-east-1. Every Linux
  # machine is Graviton (arm64). If you change a type to an Intel or AMD (x86) type, change its image to the amd64 one.
  WazuhType: {Type: String, Default: t4g.xlarge, Description: "Wazuh needs at least 4 vCPU and 8 GiB of memory"}
  LinuxVictimType: {Type: String, Default: t4g.micro}
  KaliType: {Type: String, Default: t4g.small}
  AdminType: {Type: String, Default: t4g.nano}
  NatType: {Type: String, Default: t4g.nano}
  WindowsType: {Type: String, Default: t3.medium}
  UbuntuAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id
    Description: Ubuntu 24.04 for the Wazuh server, the practice server and the Kali host (Graviton by default)
  AdminAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id
    Description: Ubuntu 24.04 for the administrator computer (Graviton by default)
  NatAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-arm64
    Description: Amazon Linux 2023 for the NAT instance (Graviton by default)
  WindowsAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base

Conditions:
  WithWindows: !Equals [!Ref IncludeWindows, "true"]
  # Burstable types (t3, t3a, t4g) get "standard" CPU credits, so a busy machine slows down instead of adding charges.
  # The Wazuh server is the exception (see its comment).
  VictimBurst: !Or [!Equals [!Select [0, !Split [".", !Ref LinuxVictimType]], t4g], !Equals [!Select [0, !Split [".", !Ref LinuxVictimType]], t3], !Equals [!Select [0, !Split [".", !Ref LinuxVictimType]], t3a]]
  KaliBurst: !Or [!Equals [!Select [0, !Split [".", !Ref KaliType]], t4g], !Equals [!Select [0, !Split [".", !Ref KaliType]], t3], !Equals [!Select [0, !Split [".", !Ref KaliType]], t3a]]
  AdminBurst: !Or [!Equals [!Select [0, !Split [".", !Ref AdminType]], t4g], !Equals [!Select [0, !Split [".", !Ref AdminType]], t3], !Equals [!Select [0, !Split [".", !Ref AdminType]], t3a]]
  NatBurst: !Or [!Equals [!Select [0, !Split [".", !Ref NatType]], t4g], !Equals [!Select [0, !Split [".", !Ref NatType]], t3], !Equals [!Select [0, !Split [".", !Ref NatType]], t3a]]
  WindowsBurst: !Or [!Equals [!Select [0, !Split [".", !Ref WindowsType]], t4g], !Equals [!Select [0, !Split [".", !Ref WindowsType]], t3], !Equals [!Select [0, !Split [".", !Ref WindowsType]], t3a]]

Resources:
  # ---------- the network: one VPC, one small public subnet for the NAT instance, two private subnets ----------
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.20.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags: [{Key: Name, Value: soc-lab-vpc}, {Key: Project, Value: soc-course-lab}]
  Igw:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags: [{Key: Name, Value: soc-lab-igw}, {Key: Project, Value: soc-course-lab}]
  IgwAttach:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties: {VpcId: !Ref Vpc, InternetGatewayId: !Ref Igw}
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.20.0.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
      Tags: [{Key: Name, Value: soc-lab-public-nat-only}, {Key: Project, Value: soc-course-lab}]
  LabSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.20.1.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
      Tags: [{Key: Name, Value: soc-lab-private-servers}, {Key: Project, Value: soc-course-lab}]
  AttackerSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      CidrBlock: 10.20.2.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
      Tags: [{Key: Name, Value: soc-lab-private-attacker}, {Key: Project, Value: soc-course-lab}]
  PublicRoutes:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags: [{Key: Name, Value: soc-lab-public-routes}, {Key: Project, Value: soc-course-lab}]
  PublicDefault:
    Type: AWS::EC2::Route
    DependsOn: IgwAttach
    Properties: {RouteTableId: !Ref PublicRoutes, DestinationCidrBlock: 0.0.0.0/0, GatewayId: !Ref Igw}
  PublicAssoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: {SubnetId: !Ref PublicSubnet, RouteTableId: !Ref PublicRoutes}
  PrivateRoutes:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags: [{Key: Name, Value: soc-lab-private-routes}, {Key: Project, Value: soc-course-lab}]
  PrivateDefault:
    Type: AWS::EC2::Route
    Properties: {RouteTableId: !Ref PrivateRoutes, DestinationCidrBlock: 0.0.0.0/0, InstanceId: !Ref NatInstance}
  LabAssoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: {SubnetId: !Ref LabSubnet, RouteTableId: !Ref PrivateRoutes}
  AttackerAssoc:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties: {SubnetId: !Ref AttackerSubnet, RouteTableId: !Ref PrivateRoutes}

  # ---------- security groups: only the lab's own traffic, nothing from the internet ----------
  NatSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: NAT instance. Accepts traffic only from inside the lab VPC, so the private machines can download updates.
      VpcId: !Ref Vpc
      SecurityGroupIngress: [{IpProtocol: "-1", CidrIp: 10.20.0.0/16, Description: "from the lab machines only"}]
      Tags: [{Key: Name, Value: soc-lab-nat}, {Key: Project, Value: soc-course-lab}]
  WazuhSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Wazuh server. Agents may send events (1514) and enrol (1515). Nothing else comes in.
      VpcId: !Ref Vpc
      Tags: [{Key: Name, Value: soc-lab-wazuh}, {Key: Project, Value: soc-course-lab}]
  VictimSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Ubuntu practice server. SSH only from the attacker and the administrator computer.
      VpcId: !Ref Vpc
      Tags: [{Key: Name, Value: soc-lab-linux-victim}, {Key: Project, Value: soc-course-lab}]
  WindowsSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Windows practice server. Remote Desktop only from the attacker.
      VpcId: !Ref Vpc
      Tags: [{Key: Name, Value: soc-lab-windows-victim}, {Key: Project, Value: soc-course-lab}]
  AdminSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: The administrator computer. Nothing comes in.
      VpcId: !Ref Vpc
      Tags: [{Key: Name, Value: soc-lab-admin}, {Key: Project, Value: soc-course-lab}]
  AttackerSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Kali attacker. Nothing comes in. Out only to the lab, plus web ports for software downloads.
      VpcId: !Ref Vpc
      SecurityGroupEgress:
        - {IpProtocol: "-1", CidrIp: 10.20.0.0/16, Description: "anything inside the lab"}
        - {IpProtocol: tcp, FromPort: 443, ToPort: 443, CidrIp: 0.0.0.0/0, Description: "HTTPS for apt, Docker images and Session Manager"}
        - {IpProtocol: tcp, FromPort: 80, ToPort: 80, CidrIp: 0.0.0.0/0, Description: "HTTP for apt mirrors"}
      Tags: [{Key: Name, Value: soc-lab-attacker}, {Key: Project, Value: soc-course-lab}]
  WazuhFromLinux:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: {GroupId: !Ref WazuhSg, IpProtocol: tcp, FromPort: 1514, ToPort: 1515, SourceSecurityGroupId: !Ref VictimSg, Description: "Linux agent"}
  WazuhFromWindows:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: {GroupId: !Ref WazuhSg, IpProtocol: tcp, FromPort: 1514, ToPort: 1515, SourceSecurityGroupId: !Ref WindowsSg, Description: "Windows agent"}
  VictimFromAttacker:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: {GroupId: !Ref VictimSg, IpProtocol: tcp, FromPort: 22, ToPort: 22, SourceSecurityGroupId: !Ref AttackerSg, Description: "SSH from the Kali attacker"}
  VictimFromAdmin:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: {GroupId: !Ref VictimSg, IpProtocol: tcp, FromPort: 22, ToPort: 22, SourceSecurityGroupId: !Ref AdminSg, Description: "SSH from the administrator"}
  WindowsFromAttacker:
    Type: AWS::EC2::SecurityGroupIngress
    Properties: {GroupId: !Ref WindowsSg, IpProtocol: tcp, FromPort: 3389, ToPort: 3389, SourceSecurityGroupId: !Ref AttackerSg, Description: "RDP from the Kali attacker"}

  # ---------- one role for every machine: Session Manager only ----------
  SsmRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement: [{Effect: Allow, Principal: {Service: ec2.amazonaws.com}, Action: sts:AssumeRole}]
      # Only what Session Manager and Run Command need. Unlike AmazonSSMManagedInstanceCore, it cannot read
      # Parameter Store, because the practice server is meant to be broken into and its role must be worth nothing.
      Policies:
        - PolicyName: soc-lab-session-manager-only
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ssm:UpdateInstanceInformation
                  - ssm:ListInstanceAssociations
                  - ssm:ListAssociations
                  - ssm:DescribeAssociation
                  - ssm:UpdateInstanceAssociationStatus
                  - ssm:UpdateAssociationStatus
                  - ssm:PutInventory
                  - ssm:PutComplianceItems
                  - ssm:GetDocument
                  - ssm:DescribeDocument
                  - ssmmessages:CreateControlChannel
                  - ssmmessages:CreateDataChannel
                  - ssmmessages:OpenControlChannel
                  - ssmmessages:OpenDataChannel
                  - ec2messages:AcknowledgeMessage
                  - ec2messages:DeleteMessage
                  - ec2messages:FailMessage
                  - ec2messages:GetEndpoint
                  - ec2messages:GetMessages
                  - ec2messages:SendReply
                Resource: "*"
      Tags: [{Key: Project, Value: soc-course-lab}]
  SsmProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: {Roles: [!Ref SsmRole]}

  # ---------- the machines ----------
  NatInstance:
    Type: AWS::EC2::Instance
    DependsOn: [IgwAttach, PublicDefault, PublicAssoc]
    Properties:
      CreditSpecification: !If [NatBurst, {CPUCredits: standard}, !Ref AWS::NoValue]
      BlockDeviceMappings: [{DeviceName: /dev/xvda, Ebs: {VolumeSize: 8, VolumeType: gp3, DeleteOnTermination: true, Encrypted: true}}]
      ImageId: !Ref NatAmi
      InstanceType: !Ref NatType
      SourceDestCheck: false
      IamInstanceProfile: !Ref SsmProfile
      MetadataOptions: {HttpTokens: required}
      PropagateTagsToVolumeOnCreation: true
      NetworkInterfaces:
        - {DeviceIndex: "0", SubnetId: !Ref PublicSubnet, PrivateIpAddress: 10.20.0.10, AssociatePublicIpAddress: true, GroupSet: [!Ref NatSg]}
      Tags: [{Key: Name, Value: soc-lab-nat}, {Key: Project, Value: soc-course-lab}]
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # A NAT instance, as in the AWS VPC guide: forward and masquerade traffic from the private subnets.
          set -eu
          until dnf install -y iptables-services; do sleep 10; done
          systemctl enable --now iptables
          echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/custom-ip-forwarding.conf
          sysctl -p /etc/sysctl.d/custom-ip-forwarding.conf
          IF=$(ip route | awk '/^default/ {print $5; exit}')
          iptables -t nat -A POSTROUTING -o "$IF" -j MASQUERADE
          iptables -F FORWARD
          service iptables save

  WazuhServer:
    Type: AWS::EC2::Instance
    DependsOn: PrivateDefault
    Properties:
      ImageId: !Ref UbuntuAmi
      InstanceType: !Ref WazuhType
      # The Wazuh server keeps AWS's default "unlimited" credits, so its CPU-heavy first install is not slowed down.
      # Borrowed CPU time above the baseline costs $0.04 per vCPU-hour on t4g: about a cent or two for the install.
      IamInstanceProfile: !Ref SsmProfile
      MetadataOptions: {HttpTokens: required}
      PropagateTagsToVolumeOnCreation: true
      BlockDeviceMappings: [{DeviceName: /dev/sda1, Ebs: {VolumeSize: 50, VolumeType: gp3, DeleteOnTermination: true, Encrypted: true}}]
      NetworkInterfaces:
        - {DeviceIndex: "0", SubnetId: !Ref LabSubnet, PrivateIpAddress: 10.20.1.10, GroupSet: [!Ref WazuhSg]}
      Tags: [{Key: Name, Value: soc-lab-wazuh-server}, {Key: Project, Value: soc-course-lab}]
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # Wazuh 4.14 all-in-one with the official installation assistant (indexer, server and dashboard).
          set -eu
          export HOME=/root
          hostnamectl set-hostname wazuh-server
          until curl -sf --max-time 5 -o /dev/null https://packages.wazuh.com/key/GPG-KEY-WAZUH; do sleep 10; done
          cd /root
          curl -sfO https://packages.wazuh.com/4.14/wazuh-install.sh
          bash ./wazuh-install.sh -a > /root/wazuh-install.log 2>&1
          tar -O -xf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt > /root/wazuh-passwords.txt
          awk "/indexer_username: 'admin'/{getline; gsub(/.*: '|'.*/,\"\"); print; exit}" /root/wazuh-passwords.txt > /root/admin-password
          chmod 600 /root/wazuh-passwords.txt /root/admin-password
          # keep the lab on 4.14: stop apt from upgrading Wazuh by accident, as the Wazuh quickstart advises
          sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
          touch /root/wazuh-ready

  LinuxVictim:
    Type: AWS::EC2::Instance
    DependsOn: PrivateDefault
    Properties:
      ImageId: !Ref UbuntuAmi
      InstanceType: !Ref LinuxVictimType
      CreditSpecification: !If [VictimBurst, {CPUCredits: standard}, !Ref AWS::NoValue]
      IamInstanceProfile: !Ref SsmProfile
      MetadataOptions: {HttpTokens: required}
      PropagateTagsToVolumeOnCreation: true
      BlockDeviceMappings: [{DeviceName: /dev/sda1, Ebs: {VolumeSize: 8, VolumeType: gp3, DeleteOnTermination: true, Encrypted: true}}]
      NetworkInterfaces:
        - {DeviceIndex: "0", SubnetId: !Ref LabSubnet, PrivateIpAddress: 10.20.1.20, GroupSet: [!Ref VictimSg]}
      Tags: [{Key: Name, Value: soc-lab-linux-server-01}, {Key: Project, Value: soc-course-lab}]
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          # The practice server: user "student" with a weak password, SSH password logins on, and a Wazuh agent.
          # No "set -x" here, so the lab password is not copied into the boot log.
          set -euo pipefail
          export HOME=/root
          hostnamectl set-hostname linux-server-01
          echo "127.0.1.1 linux-server-01" >> /etc/hosts
          useradd -m -s /bin/bash student
          echo 'student:${LabPassword}' | chpasswd
          # sshd keeps the first value it reads, and the cloud image's own file says "no", so this file sorts first
          printf 'PasswordAuthentication yes\nKbdInteractiveAuthentication no\n' > /etc/ssh/sshd_config.d/10-soc-lab.conf
          systemctl restart ssh
          # rsyslog read the old hostname at boot: restart it so /var/log/auth.log says linux-server-01 too
          systemctl restart rsyslog
          until curl -sf --max-time 5 -o /dev/null https://packages.wazuh.com/key/GPG-KEY-WAZUH; do sleep 10; done
          curl -sf https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
          chmod 644 /usr/share/keyrings/wazuh.gpg
          echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
          APT="apt-get -o DPkg::Lock::Timeout=600"
          $APT update
          WAZUH_MANAGER=10.20.1.10 WAZUH_AGENT_NAME=linux-server-01 $APT install -y wazuh-agent=4.14.10-1
          echo "wazuh-agent hold" | dpkg --set-selections
          systemctl daemon-reload
          systemctl enable --now wazuh-agent

  AdminComputer:
    Type: AWS::EC2::Instance
    DependsOn: PrivateDefault
    Properties:
      ImageId: !Ref AdminAmi
      InstanceType: !Ref AdminType
      CreditSpecification: !If [AdminBurst, {CPUCredits: standard}, !Ref AWS::NoValue]
      BlockDeviceMappings: [{DeviceName: /dev/sda1, Ebs: {VolumeSize: 8, VolumeType: gp3, DeleteOnTermination: true, Encrypted: true}}]
      IamInstanceProfile: !Ref SsmProfile
      MetadataOptions: {HttpTokens: required}
      PropagateTagsToVolumeOnCreation: true
      NetworkInterfaces:
        - {DeviceIndex: "0", SubnetId: !Ref LabSubnet, PrivateIpAddress: 10.20.1.50, GroupSet: [!Ref AdminSg]}
      Tags: [{Key: Name, Value: soc-lab-admin-pc}, {Key: Project, Value: soc-course-lab}]
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # The administrator's own computer, so ordinary admin logins come from a known address.
          set -eu
          hostnamectl set-hostname admin-pc
          until curl -sf --max-time 5 -o /dev/null https://packages.wazuh.com/key/GPG-KEY-WAZUH; do sleep 10; done
          APT="apt-get -o DPkg::Lock::Timeout=600"
          $APT update && $APT install -y sshpass

  KaliAttacker:
    Type: AWS::EC2::Instance
    DependsOn: PrivateDefault
    Properties:
      ImageId: !Ref UbuntuAmi
      InstanceType: !Ref KaliType
      CreditSpecification: !If [KaliBurst, {CPUCredits: standard}, !Ref AWS::NoValue]
      IamInstanceProfile: !Ref SsmProfile
      MetadataOptions: {HttpTokens: required}
      PropagateTagsToVolumeOnCreation: true
      BlockDeviceMappings: [{DeviceName: /dev/sda1, Ebs: {VolumeSize: 20, VolumeType: gp3, DeleteOnTermination: true, Encrypted: true}}]
      NetworkInterfaces:
        - {DeviceIndex: "0", SubnetId: !Ref AttackerSubnet, PrivateIpAddress: 10.20.2.66, GroupSet: [!Ref AttackerSg]}
      Tags: [{Key: Name, Value: soc-lab-kali-attacker}, {Key: Project, Value: soc-course-lab}]
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # The attacker: Kali Linux from the official kalilinux/kali-rolling image, with hydra and sshpass added.
          # It shares this machine's network, so its address is 10.20.2.66.
          set -eu
          hostnamectl set-hostname kali
          until curl -sf --max-time 5 -o /dev/null https://packages.wazuh.com/key/GPG-KEY-WAZUH; do sleep 10; done
          APT="apt-get -o DPkg::Lock::Timeout=600"
          $APT update && $APT install -y docker.io
          mkdir -p /opt/kali
          printf 'FROM kalilinux/kali-rolling\nRUN apt-get update && apt-get install -y --no-install-recommends hydra sshpass openssh-client nmap iputils-ping && rm -rf /var/lib/apt/lists/*\nWORKDIR /lab\n' > /opt/kali/Dockerfile
          printf 'password\n123456\nqwerty\nletmein\nwelcome\nadmin\nstudent\n111111\niloveyou\ndragon\n' > /opt/kali/guesses.txt
          docker build -t soc-kali /opt/kali
          printf '#!/bin/sh\nexec docker run --rm -it --network host -v /opt/kali:/lab soc-kali bash\n' > /usr/local/bin/kali
          chmod 755 /usr/local/bin/kali
          touch /opt/kali/ready

  WindowsVictim:
    Type: AWS::EC2::Instance
    Condition: WithWindows
    DependsOn: PrivateDefault
    Properties:
      ImageId: !Ref WindowsAmi
      InstanceType: !Ref WindowsType
      CreditSpecification: !If [WindowsBurst, {CPUCredits: standard}, !Ref AWS::NoValue]
      IamInstanceProfile: !Ref SsmProfile
      MetadataOptions: {HttpTokens: required}
      PropagateTagsToVolumeOnCreation: true
      BlockDeviceMappings: [{DeviceName: /dev/sda1, Ebs: {VolumeSize: 30, VolumeType: gp3, DeleteOnTermination: true, Encrypted: true}}]
      NetworkInterfaces:
        - {DeviceIndex: "0", SubnetId: !Ref LabSubnet, PrivateIpAddress: 10.20.1.30, GroupSet: [!Ref WindowsSg]}
      Tags: [{Key: Name, Value: soc-lab-win-server-01}, {Key: Project, Value: soc-course-lab}]
      UserData:
        Fn::Base64: |
          <powershell>
          # Windows practice server: Sysmon with the SwiftOnSecurity configuration (CC BY 4.0), and a Wazuh agent that reads it.
          $ErrorActionPreference = "Stop"
          New-Item -ItemType Directory -Force C:\lab | Out-Null
          while ($true) { try { Invoke-WebRequest https://packages.wazuh.com/key/GPG-KEY-WAZUH -UseBasicParsing -TimeoutSec 10 | Out-Null; break } catch { Start-Sleep 10 } }
          Invoke-WebRequest https://download.sysinternals.com/files/Sysmon.zip -OutFile C:\lab\Sysmon.zip -UseBasicParsing
          Expand-Archive C:\lab\Sysmon.zip C:\lab\sysmon -Force
          Invoke-WebRequest https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/1836897f12fbd6a0a473665ef6abc34a6b497e31/sysmonconfig-export.xml -OutFile C:\lab\sysmonconfig.xml -UseBasicParsing
          & C:\lab\sysmon\Sysmon64.exe -accepteula -i C:\lab\sysmonconfig.xml
          Invoke-WebRequest https://packages.wazuh.com/4.x/windows/wazuh-agent-4.14.10-1.msi -OutFile C:\lab\wazuh-agent.msi -UseBasicParsing
          Start-Process msiexec.exe -Wait -ArgumentList '/i C:\lab\wazuh-agent.msi /q WAZUH_MANAGER="10.20.1.10" WAZUH_AGENT_NAME="win-server-01"'
          Add-Content "C:\Program Files (x86)\ossec-agent\ossec.conf" "`n<ossec_config><localfile><location>Microsoft-Windows-Sysmon/Operational</location><log_format>eventchannel</log_format></localfile></ossec_config>"
          Start-Service wazuhsvc
          New-Item C:\lab\ready -ItemType File | Out-Null
          </powershell>

Outputs:
  WazuhServer: {Value: !Ref WazuhServer}
  LinuxVictim: {Value: !Ref LinuxVictim}
  AdminComputer: {Value: !Ref AdminComputer}
  KaliAttacker: {Value: !Ref KaliAttacker}
  NatInstance: {Value: !Ref NatInstance}
  WindowsVictim: {Condition: WithWindows, Value: !Ref WindowsVictim}