Purple › Module 3 › Lesson 2
Telemetry Needs
Telemetry needs literacy names log sources, field requirements, and coverage prerequisites — map telemetry on YOUR $PURPLE_LAB before authoring rules.
Visual · t35_telemetry_needs
Telemetry needs literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
Rules without telemetry detect nothing — literacy teaches source and field requirements so detection engineering starts with data you can collect on lab hosts.
Detection rules need telemetry — process creation logs, command-line arguments, network connections, authentication events, DNS queries. Each ATT&CK technique maps to required sources and fields. Missing Sysmon on lab hosts means no command-line detection for T1059. Cyberlium maps telemetry on YOUR $PURPLE_LAB — write source row for three techniques with required fields. Next: False Positive Cost.
1. Telemetry components (named)
Sources: EDR process events, Windows Security 4688, Sysmon Event ID 1, DNS logs, proxy logs, cloud audit trails — on YOUR lab hosts. Fields: Image, CommandLine, ParentImage, DestinationIp, QueryName. Prerequisites: agent enrolled, log forwarding configured, retention sufficient for replay.
On $PURPLE_LAB, write telemetry row — technique ID, required source, required fields for fictional T1059 rule.
Command guide
Try these commands — Telemetry components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE data sources — https://attack.mitre.org/datasources/ Elastic data sources — https://www.elastic.co/guide/en/security/current/rules-ui.html Sigma logsource — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/notes/telemetry-needs.md" <<'EOF'
# Telemetry Needs — YOUR purple lab
| Technique (lab) | Required logs | Lab source |
|---|---|---|
| T1110.001 failed logon | Windows 4625/4624 | telemetry/auth.jsonl |
| T1082 system info | process/cmdline audit | optional T1082 on YOUR VM |
| T1059.001 PowerShell | 4688 process creation | extend jsonl if brief assigns |
Gap: if log missing → detection cannot fire → document in coverage CSV
Seed FAKE jsonl first — validate rule before any live sim
EOFCommand — copy this
grep -E 'T1110|T1082|auth.jsonl|coverage' "$PURPLE_LAB/notes/telemetry-needs.md" curl -sS https://attack.mitre.org/datasources/ | head -8
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE data sources (https://attack.mitre.org/datasources/); Elastic data sources (https://www.elastic.co/guide/en/security/current/rules-ui.html); Sigma logsource (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why telemetry literacy prevents blind rules
Rule matching CommandLine without Sysmon deployed never fires. Missing DNS logs blocks C2 detection. Purple exercises expose telemetry gaps before production incidents.
Students document lab telemetry on notes — production mapping follows data inventory and collection policies.
3. Lab boundary
Forbidden: assuming production telemetry exists without verifying on lab hosts. Allowed: telemetry needs card — three techniques with sources and fields on $PURPLE_LAB.
Ship: telemetry needs card for YOUR lab hosts. Next: False Positive Cost.
4. What you ship: telemetry needs card for $PURPLE_LAB
Three techniques with sources and fields. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Telemetry needs card. $PURPLE_LAB named. File t35-m03-l02-telemetry-needs.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Author rule requiring fields your lab hosts do not collect. Skip telemetry check before deploy.
Right
Write telemetry needs card for YOUR $PURPLE_LAB. Next: False Positive Cost.
Mission: map telemetry on YOUR lab hosts
1) List five log sources for detection. 2) Write telemetry rows for three ATT&CK techniques. 3) Note which sources are enabled on YOUR lab hosts. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Check collection before authoring — telemetry gap is a detection gap.
Knowledge Check
APPLY: Telemetry needs primarily define:
Multiple choice
Knowledge Check
APPLY: True or False: T1059 command-line detection typically requires process creation logs with CommandLine field.
True or False
Knowledge Check
APPLY: Telemetry literacy on Cyberlium uses:
Multiple choice