A reproducible edge intrusion-detection / prevention lab on the SPHERE (MergeTB) testbed.

Topology (4 nodes): a compromised edge device and a benign edge device share an edge LAN with a gateway; the gateway mirrors edge-LAN traffic to a Suricata sensor.

• edge — runs a multi-stage attack: reconnaissance (SYN/FIN/XMAS scans) → web exploitation (path traversal, SQL injection, malicious user-agent) → SSH brute force → DNS-tunnel exfiltration.
• edge2 — benign baseline (normal web + ping).
• gw — gateway hosting a victim web service and a software traffic mirror (tc) to the sensor.
• mon — Suricata IDS with categorized rules logging to eve.json.

What you get: Run the weave to recreate the experiment (push model → realize → materialize). A bundled Jupyter notebook deploys the tooling, then analyzes and visualizes the alerts (topology graph, alerts by signature/category, severity, top talkers, attack graph, timeline) and runs a closed-loop IPS that auto-blocks the attacker on the gateway while the benign device keeps working.

Requires a SPHERE project with moddeter access.