Purpose
This guide set defines a repeatable build process for a small DFIR kit hosted on a standalone VMware ESXi host. The kit supports host image staging, artifact extraction, CSV-based timeline ingestion, analyst collaboration, and Kibana-based review without requiring vCenter.
The design assumes a segmented lab network where the NAS stores evidence and staging data, the FLARE VM performs Windows-based triage and tool execution, and the ELK VM indexes curated artifact CSVs for hunting and correlation. These documents are written as a deployment and validation playbook, not a theory overview.
Target architecture
Standalone ESXi host
├── Management network (vmnic0 / Host Client access)
└── Segmented DFIR port group — lab subnet 172.16.0.0/24
├── NAS VM 172.16.0.10 Samba: ingest, evidence, vault
├── ELK VM 172.16.0.20 Elasticsearch, Logstash, Kibana
├── FLARE VM 172.16.0.x Windows analysis workstation(s)
└── Analyst systems as required (see NAS guide for mount policy)
Operational principles
- Keep original evidence read-only whenever practical.
- Separate evidence storage from working ingest copies.
- Use the NAS as controlled storage and the ELK VM local disk for Logstash processing (see ELK deployment guide).
- Use snapshots or templates for infrastructure rollback; do not treat snapshots as evidence backups.
- Document credentials in an approved vault, not in these public-facing pages.
- Validate each service before moving to the next deployment phase.
- Use 07 Artifact carving for EvtxECmd, Hayabusa, MFTECmd, and Plaso exports matched to ELK filenames (KAPE can cover much of the acquisition; the guide explains each tool for clarity and troubleshooting).
IP addressing baseline
| Item | Standard / value |
|---|---|
| Lab CIDR | 172.16.0.0/24 |
| Default gateway | 172.16.0.1 |
| NAS VM | 172.16.0.10 |
| ELK VM | 172.16.0.20 |
| FLARE VM | Static or DHCP reservation inside 172.16.0.0/24 |