###### Abstract
Let us emphasize that in the case of critical facilities such as power plants, water networks, mines, or transport systems, thorough real cyberattacks on the real working infrastructure meant to evaluate its resilience are practically impossible since they create too much risk, as any disruption could have serious consequences for the operation of the entire system [32]. Therefore, the effectiveness of cyberattack detection and mitigation mechanisms can only be fully verified under laboratory conditions [33]. Experiments carried out in laboratories allow us to assess the efficiency of cyberattack detection and mitigation systems, considering a very rich set of scenarios for the simulated attacks that are too dangerous in practice. Such laboratory experiments make it possible to verify the efficiency of existing protection systems and develop new methods when necessary [34]. We have to stress that although tests in laboratories are very useful, they cannot completely replace monitoring for real attacks in actual applications. However, laboratory tests provide an opportunity to safely verify if and to what extent the existing or newly developed security measures are effective before they are applied to the actual critical systems. Thanks to such an approach, the risk associated with implementing new solutions can be minimized. The laboratory testing methodology used is critical from the point of view of developing efficient cyberattack monitoring and mitigation methods. In particular, we must ensure that the test laboratory environment correctly replicates the necessary infrastructure, which is often difficult and costly [35]. When this issue poses problems, the solution may be to replicate the process in a simplified manner, e.g., using a much less complex hardware environment [36], but with the objective of obtaining conditions as close as possible to those of the actual installation. Such an approach would be much cheaper than replicating the entire system architecture in a laboratory environment. The article discusses the issues concerned with testing the cyber resilience of a system operating in a coal mine located in Poland. It describes the problem of replicating a real system in the laboratory, as well as the necessary tools and methods used to implement a resilient system architecture. In particular, we focus on how to use the software tools appropriately and modify network traffic to simulate the most likely cyberattacks. The proposed approach is based directly on network traffic, which creates opportunities for a full spectrum of testing and not just the vulnerability evaluation of automatic control algorithms [34]. The key is to use the traffic from the real site for which the solution is being developed, an approach that allows for the preparation of cybersecurity methods and their reliable testing without disrupting the target industrial system. It is worth noting that conducting simulated attacks directed at a critical infrastructure's industrial environment is unacceptable. Operating on network traffic allows for the simulation of the following tests: penetration, resilience, configuration, and system scanning for known vulnerabilities. The proposed solution is designed to be generic and flexible, so it can be applied in different contexts without significant modifications. This approach enables greater scalability, reuse, and adaptation to new needs and requirements. This article is structured in the following way. First, Section 2 describes the IT/OT infrastructure in the coal mine. Section 3 deals with the laboratory infrastructure, while Section 4 presents the software tools used to record, modify, and replay the network traffic, and Section 5 defines cyberattacks' scenarios and discusses the obtained results. Finally, Section 6 summarizes and concludes the article.