Replay Logs

Replay logs literacy names historical log injection, simulation telemetry replay, and batch validation — plan replay on YOUR $PURPLE_LAB before production rule rollout.

Replay Logs• Audio Walkthrough

00:00/03:26

Visual · t35_replay_logs

Replay logs literacy. $PURPLE_LAB only. Original Cyberlium.

Past logs predict future alerts — literacy teaches log replay so detection engineers validate rules against lab telemetry you captured.

Log replay injects historical or simulated events into test SIEM indexes or offline replay engines — validates rule logic at scale beyond single unit tests. Sources include purple exercise telemetry from YOUR lab hosts, synthetic log generators, and redacted historical samples from authorized org archives. Cyberlium plans replay on YOUR $PURPLE_LAB — write replay row for one fictional exercise log set with expected match count. Next: Baselines.

1. Replay components (named)

Log source: purple exercise output from YOUR lab hosts, synthetic generator, authorized redacted archive. Replay engine: offline Sigma tester, lab SIEM test index, pySigma replay. Expected outcome: match count, alert fields, FP count on benign subset.

On $PURPLE_LAB, write replay row — log set name, event count, expected matches for one fictional T1059 rule.

Command guide

Try these commands — Replay components (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

MITRE T1110.001 — https://attack.mitre.org/techniques/T1110/001/

Optional command

jq manual — https://jqlang.github.io/jq/manual/

Splunk replay — https://docs.splunk.com/Documentation/Splunk/latest/Data/Upload

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq
sudo apt install python3

macOS:

Command — copy this

brew install jq
brew install python3

Windows:

Command — copy this

choco install jq

Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/telemetry/auth.jsonl" <<'EOF'
{"ts":"2026-08-22T06:10:01Z","event_id":4625,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T06:10:03Z","event_id":4625,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T06:10:08Z","event_id":4625,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T06:10:22Z","event_id":4624,"host":"WIN-PURPLE01","user":"jsmith","src_ip":"203.0.113.77","result":"success","reason":"network logon"}
{"ts":"2026-08-22T06:12:00Z","event_id":4624,"host":"WIN-PURPLE02","user":"svc_backup","src_ip":"10.0.3.50","result":"success","reason":"service logon"}
{"ts":"2026-08-22T06:15:33Z","event_id":4625,"host":"WIN-PURPLE01","user":"administrator","src_ip":"10.0.2.10","result":"failure","reason":"bad password"}
EOF

Command — copy this

echo 'Seeded FAKE auth.jsonl — failed-then-success pattern for purple rule test'
jq -c 'select(.event_id==4625) | {user, src_ip, ts}' "$PURPLE_LAB/telemetry/auth.jsonl"

Primary tools to practice this lesson: jq, python3. Reference sites: MITRE T1110.001 (https://attack.mitre.org/techniques/T1110/001/); jq manual (https://jqlang.github.io/jq/manual/); Splunk replay (https://docs.splunk.com/Documentation/Splunk/latest/Data/Upload). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why replay beats single-fixture tests

Unit tests cover one positive and one negative. Replay validates rule across hundreds of events — catches edge cases and FP patterns. Purple exercise logs become regression fixtures for future tuning.

Students plan lab replay on notes — production replay follows data governance and retention policies.

3. Lab boundary

Forbidden: replaying live victim logs without authorization. Allowed: replay logs card — log set and expected outcome with $PURPLE_LAB fictional exercise telemetry.

Ship: replay logs card for YOUR lab exercise. Next: Baselines.

4. What you ship: replay logs card for $PURPLE_LAB

Log set, event count, expected matches. $PURPLE_LAB named. chmod 600.

5. What you record before the next lesson

Date. Replay logs card. $PURPLE_LAB named. File t35-m05-l02-replay-logs.txt chmod 600.

6. Wrong vs right: stranger networks vs YOUR purple lab

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Replay live victim breach logs from public dump. Skip expected outcome documentation.
Right: Write replay logs card for YOUR $PURPLE_LAB. Next: Baselines.

Hands-on Exercise