Lion Cipher Lab

Monitor your infrastructure with Zabbix (server, agent, a trigger, and a real alert)

• Cyber / Security Engineer
• Intermediate
• ~60 min
• Free · no account required

Why it matters

You cannot defend, or even trust, infrastructure you cannot see. Monitoring is the layer that tells you a server is alive, a disk is filling, a service restarted at 3am, or a box that should be busy has gone silent — and it is a genuine security control, not just an ops convenience. An attacker who lands on a host often shows up first as a monitoring anomaly: CPU pegged by a crypto-miner, an unexpected service restart, a spike in failed logins, or a machine that suddenly stops reporting because it was taken down or isolated. If nobody is watching those signals centrally, the first person to…

What you'll learn

• what Zabbix is and the four pieces of its architecture (server, database, web frontend, agent)
• standing up the whole stack from the official Zabbix Docker Compose with one command
• logging into the Zabbix web UI and finding the host it monitors out of the box
• the difference between an item, a template, a trigger, and an action
• reading live metrics (Monitoring -> Latest data) and picking a threshold from real numbers instead of guessing
• writing a trigger expression and a trigger action that alerts on a condition
• firing that condition on demand and watching the Problem raise and then auto-resolve
• the security angle: why centralized monitoring catches a wedged service, a crypto-miner, or a host that went dark
• the judgment call of Zabbix vs Prometheus/Grafana vs Uptime Kuma vs Nagios — and when NOT to reach for Zabbix

Steps in this lab

1. The words first: what Zabbix is and its four moving parts
2. When to reach for Zabbix — and when NOT to (read before you build)
3. Get the official Compose and bring the whole stack up
4. Log into the web UI and find the host it already monitors
5. Watch real metrics arrive, and learn agent 'passive vs active'
6. Read the current CPU load, then write a trigger on it
7. Create an action so the condition actually alerts someone
8. Fire it for real: burn CPU, watch the Problem raise and resolve
9. Why this is a security control — and cleaning up

Open the full interactive lab →