Defensive › Module 5 › Lesson 4
Logging Lab
Logging pack on $LAB_HOST — categories, retention, one alert rule.
Visual · logging_lab
Lab: logging policy pack. $LAB_HOST only. Original Cyberlium.
Opening
Policy on paper, logs on YOUR host, chmod 600 on the proof.
Module 5 lessons covered what to log, retention/privacy, and alert hygiene. This lab ships a combined logging policy pack for $LAB_HOST: categories, retention days, privacy lines, one alert rule with runbook stub. Optional: verify one log source is enabled on lab. Next: Quiz — Logging Fundamentals.
1. Lab contract: assemble the pack
Merge lessons 5-1 through 5-3 into one file under $HOME/cyberlium-lab. Verify hostname $LAB_HOST on every section.
Optional: enable or verify Windows Security log / Linux auth log capture on lab.
Command guide
Try these commands — Lab contract: assemble the pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Logging lab — https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html Elastic observability — https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
journalctl -n 50 --no-pager -o json 2>/dev/null | python3 -c "import sys,json; d=[json.loads(l) for l in sys.stdin if l.strip()]; print('events',len(d)); print('fields',list(d[0].keys())[:8] if d else [])" 2>/dev/null || journalctl -n 20 --no-pager
journalctl -n 20 --no-pager 2>/dev/null | tee "$HOME/cyberlium-lab/t16-defense/sample.log" | head -10Primary tools to practice this lesson: journalctl, python3. Reference sites: Logging lab (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); Elastic observability (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Forbidden
Forward logs from classmate machines, PCAP all café traffic, publish raw logs publicly, SIEM on stranger data.
3. Close
chmod 600. Quiz next — then Windows and Linux Logs.
4. What you ship: logging policy pack for $LAB_HOST
Categories, retention, privacy, alert rule. Optional log source verify. chmod 600.
5. What you record before the next lesson
Date. Logging pack complete on $LAB_HOST. File t16-m05-l04-logging-lab.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include neighbor DHCP logs. Skip privacy lines.
Right
Logging pack on $LAB_HOST. Next: Quiz — Logging Fundamentals.
Mission: logging evidence pack
1) Merge category, retention, alert sections. 2) Verify $LAB_HOST on each line. 3) Optional log source check. 4) chmod 600. Never log stranger systems.
Stuck? Ask Cyberlium AI Mentor
A one-page policy beats a SIEM you aim at strangers.
Knowledge Check
APPLY: Logging Lab pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: chmod 600 applies to logging policy notes.
True or False
Knowledge Check
APPLY: Forwarding logs from PC you do not own:
Multiple choice