SPHERE edge-security lab: a compromised edge device runs a multi-stage attack (recon, web exploits, SSH brute-force, DNS exfiltration) against a gateway that mirrors traffic to a Suricata IDS. Includes a benign baseline and a closed-loop IPS auto-block.