Telemetry Needs
Telemetry needs literacy names log sources, field requirements, and coverage prerequisites — map telemetry on YOUR $PURPLE_LAB before authoring rules.
Visual · t35_telemetry_needs
Telemetry needs literacy. $PURPLE_LAB only. Original Cyberlium.
Rules without telemetry detect nothing — literacy teaches source and field requirements so detection engineering starts with data you can collect on lab hosts.
Detection rules need telemetry — process creation logs, command-line arguments, network connections, authentication events, DNS queries. Each ATT&CK technique maps to required sources and fields. Missing Sysmon on lab hosts means no command-line detection for T1059. Cyberlium maps telemetry on YOUR $PURPLE_LAB — write source row for three techniques with required fields. Next: False Positive Cost.
1. Telemetry components (named)
Sources: EDR process events, Windows Security 4688, Sysmon Event ID 1, DNS logs, proxy logs, cloud audit trails — on YOUR lab hosts. Fields: Image, CommandLine, ParentImage, DestinationIp, QueryName. Prerequisites: agent enrolled, log forwarding configured, retention sufficient for replay.
On $PURPLE_LAB, write telemetry row — technique ID, required source, required fields for fictional T1059 rule.
Command guide
Try these commands — Telemetry components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE data sources (https://attack.mitre.org/datasources/); Elastic data sources (https://www.elastic.co/guide/en/security/current/rules-ui.html); Sigma logsource (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why telemetry literacy prevents blind rules
Rule matching CommandLine without Sysmon deployed never fires. Missing DNS logs blocks C2 detection. Purple exercises expose telemetry gaps before production incidents.
Students document lab telemetry on notes — production mapping follows data inventory and collection policies.
3. Lab boundary
Forbidden: assuming production telemetry exists without verifying on lab hosts. Allowed: telemetry needs card — three techniques with sources and fields on $PURPLE_LAB.
Ship: telemetry needs card for YOUR lab hosts. Next: False Positive Cost.
4. What you ship: telemetry needs card for $PURPLE_LAB
Three techniques with sources and fields. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Telemetry needs card. $PURPLE_LAB named. File t35-m03-l02-telemetry-needs.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Author rule requiring fields your lab hosts do not collect. Skip telemetry check before deploy.
- Right: Write telemetry needs card for YOUR $PURPLE_LAB. Next: False Positive Cost.
Mission: map telemetry on YOUR lab hosts
1) List five log sources for detection. 2) Write telemetry rows for three ATT&CK techniques. 3) Note which sources are enabled on YOUR lab hosts. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Check collection before authoring — telemetry gap is a detection gap.
APPLY: Telemetry needs primarily define:
APPLY: True or False: T1059 command-line detection typically requires process creation logs with CommandLine field.
APPLY: Telemetry literacy on Cyberlium uses:
False Positive Cost
Part of Purple Teaming — Detection Engineering Basics.
Lab — DE Basics
Part of Purple Teaming — Detection Engineering Basics.
Quiz — DE Basics
Part of Purple Teaming — Detection Engineering Basics.