Egress-Controlled OSINT Lab on EVE-NG Pro

OSINT tooling is unfriendly company. It phones home, pulls payloads from places you did not vet, and generally behaves like exactly the kind of traffic I am learning to detect. So I built it a room of its own.

The lab runs as an EVE-NG Pro topology with one defining rule: nothing leaves without a reason I can point to. Egress paths are controlled explicitly with owned nftables rules and routes, so the lab’s outbound traffic is a decision, never a default.

The second rule is that the build leaves a trail. The project runs on an evidence-gated workflow: every task has a close condition, every phase produces capture or log evidence, and an append-only event log records what was done and when. If I claim the lab is contained, there is a file that proves it.

This is the project where lab work stopped being tinkering and started being engineering practice: scope first, blast radius written down, evidence collected, and rollback planned before the first interface came up.