You learn defense by generating attacks and catching them. A home lab lets you do that safely - and it's the single best resume-builder for a blue-team role.
A simple, free build
- A hypervisor - VirtualBox or Proxmox (free) to run VMs.
- A victim - a Windows VM with Sysmon (use a good config like SwiftOnSecurity's) generating rich logs.
- A collector/SIEM - Wazuh or the Elastic Stack (or Security Onion, which bundles NSM + hunting) to receive and search those logs.
- A network sensor (optional) - Zeek or Suricata on a span/host to log traffic.
- An attacker box - a Kali/Linux VM to safely run tests.
Keep it isolated on a host-only network.
What to practice
- Generate telemetry - run Atomic Red Team tests mapped to ATT&CK techniques on the victim.
- Hunt them - find each test in your Sysmon/Zeek logs. Can you see the technique?
- Write detections - turn a hunt into a Sigma rule; convert and deploy it to your SIEM.
- Measure coverage - map what you can catch on the ATT&CK matrix; close the gaps.
Shortcut
Standing up infra is great practice - but if you just want reps on the analysis (which is the actual job), a browser-based platform lets you skip setup and get straight to catching real telemetry. Either way: the loop is generate -> hunt -> detect -> measure.