Purple › Module 5 › Lesson 2
Replay Logs
Replay logs literacy names historical log injection, simulation telemetry replay, and batch validation — plan replay on YOUR $PURPLE_LAB before production rule rollout.
Visual · t35_replay_logs
Replay logs literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
Past logs predict future alerts — literacy teaches log replay so detection engineers validate rules against lab telemetry you captured.
Log replay injects historical or simulated events into test SIEM indexes or offline replay engines — validates rule logic at scale beyond single unit tests. Sources include purple exercise telemetry from YOUR lab hosts, synthetic log generators, and redacted historical samples from authorized org archives. Cyberlium plans replay on YOUR $PURPLE_LAB — write replay row for one fictional exercise log set with expected match count. Next: Baselines.
1. Replay components (named)
Log source: purple exercise output from YOUR lab hosts, synthetic generator, authorized redacted archive. Replay engine: offline Sigma tester, lab SIEM test index, pySigma replay. Expected outcome: match count, alert fields, FP count on benign subset.
On $PURPLE_LAB, write replay row — log set name, event count, expected matches for one fictional T1059 rule.
Command guide
Try these commands — Replay components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1110.001 — https://attack.mitre.org/techniques/T1110/001/
Optional command
jq manual — https://jqlang.github.io/jq/manual/
Splunk replay — https://docs.splunk.com/Documentation/Splunk/latest/Data/Upload
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/telemetry/auth.jsonl" <<'EOF'
{"ts":"2026-08-22T06:10:01Z","event_id":4625,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T06:10:03Z","event_id":4625,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T06:10:08Z","event_id":4625,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T06:10:22Z","event_id":4624,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"success","reason":"network logon"}
{"ts":"2026-08-22T06:12:00Z","event_id":4624,"host":"WIN-PURPLE02","user":"svc_backup","src_ip":"10.0.3.50","result":"success","reason":"service logon"}
{"ts":"2026-08-22T06:15:33Z","event_id":4625,"host":"WIN-PURPLE01","user":"administrator","src_ip":"10.0.2.10","result":"failure","reason":"bad password"}
EOFCommand — copy this
echo 'Seeded FAKE auth.jsonl — failed-then-success pattern for purple rule test'
jq -c 'select(.event_id==4625) | {user, src_ip, ts}' "$PURPLE_LAB/telemetry/auth.jsonl"Primary tools to practice this lesson: jq, python3. Reference sites: MITRE T1110.001 (https://attack.mitre.org/techniques/T1110/001/); jq manual (https://jqlang.github.io/jq/manual/); Splunk replay (https://docs.splunk.com/Documentation/Splunk/latest/Data/Upload). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why replay beats single-fixture tests
Unit tests cover one positive and one negative. Replay validates rule across hundreds of events — catches edge cases and FP patterns. Purple exercise logs become regression fixtures for future tuning.
Students plan lab replay on notes — production replay follows data governance and retention policies.
3. Lab boundary
Forbidden: replaying live victim logs without authorization. Allowed: replay logs card — log set and expected outcome with $PURPLE_LAB fictional exercise telemetry.
Ship: replay logs card for YOUR lab exercise. Next: Baselines.
4. What you ship: replay logs card for $PURPLE_LAB
Log set, event count, expected matches. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Replay logs card. $PURPLE_LAB named. File t35-m05-l02-replay-logs.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Replay live victim breach logs from public dump. Skip expected outcome documentation.
Right
Write replay logs card for YOUR $PURPLE_LAB. Next: Baselines.
Mission: plan log replay on YOUR lab
1) List three replay log sources. 2) Write replay row with expected match count. 3) Note replay engine for lab tenant. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Exercise telemetry is gold — archive purple sim logs as replay fixtures.
Knowledge Check
APPLY: Log replay primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Purple exercise telemetry from YOUR lab hosts is an authorized replay source.
True or False
Knowledge Check
APPLY: Replay logs literacy on Cyberlium uses:
Multiple choice