Build a range you can safely break.

Start from the DMZ web application with no credentials. Reach domain administrator on the Corporate segment.

• Exploit the DMZ application to obtain a foothold
• Discover credentials reusable against the Corporate segment
• Enumerate the domain and identify an escalation path with BloodHound
• Escalate to domain administrator and document every step
• Review the SIEM afterwards: which steps generated telemetry, and which did not?

Run techniques from Atomic Red Team, then write the detection that catches each one.

• Execute a chosen ATT&CK technique from the attack workstation
• Identify the telemetry it produced in Sysmon and the SIEM
• Write a Sigma rule that detects it
• Re-run and confirm the rule fires
• Deliberately vary the technique and see whether your rule survives

Verify the firewall rules do what you believe they do. This is a real client deliverable, not just an exercise.

• Document the intended policy between every pair of segments
• Test each path systematically from both directions
• Find at least one rule that behaves differently from its description
• Produce a matrix of intended against actual reachability

Have someone else compromise the lab, then work the incident from the defender's side using only the SIEM.

• Establish the earliest evidence of compromise from logs alone
• Reconstruct the attacker's path without asking them
• Identify what evidence you wish you had collected and were not
• Write the first-hour timeline as if it were a real incident record