Network Proxy Logs

Network and proxy literacy names DNS, firewall, and web proxy fields — correlate suspicious domains on YOUR $SOC_LAB proxy JSON only.

Network Proxy Logs• Audio Walkthrough

00:00/03:36

Visual · t29_network_proxy_logs

Network/proxy literacy. $SOC_LAB only. Original Cyberlium.

Proxy saw the URL — DNS saw the lookup — literacy ties network fields to auth failures on lab timelines.

Network telemetry includes firewall allow/deny, DNS queries (query name, response code), proxy logs (URL, action, user, category), and NetFlow connection metadata. Phishing and malware literacy maps suspicious URL + rare domain + auth failure sequence on synthetic timelines — detection context only, no exploit delivery. Cyberlium maps proxy/DNS fields on YOUR $SOC_LAB JSON — fictional URLs and IPs. Next: Sources Lab.

1. Network log types (named)

DNS: query, answer, client IP — detect rare NXDOMAIN bursts or DGA-like patterns on lab data. Proxy: url, action (allow/deny), bytes, user-agent — detect suspicious categories. Firewall: src/dst IP, port, action — correlate with auth failures.

On $SOC_LAB, list four fields from one proxy JSON line in YOUR sample.

Command guide

Try these commands — Network log types (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Proxy log analysis — https://attack.mitre.org/techniques/T1566/ (phishing via proxy context) MITRE T1071 — https://attack.mitre.org/techniques/T1071/ (application layer protocol) Splunk web logs — https://docs.splunk.com/Documentation/Splunk/latest/Data/Howtomonitorproxyserverlogs

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows:

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/logs/proxy.jsonl" <<'EOF'
{"ts":"2026-08-22T03:01:12Z","user":"alice","src_ip":"10.0.2.15","url":"https://docs.example.com","action":"allow","category":"business"}
{"ts":"2026-08-22T03:05:44Z","user":"bob","src_ip":"10.0.2.22","url":"http://phish-lab.fake/login","action":"block","category":"phishing"}
{"ts":"2026-08-22T03:06:01Z","user":"bob","src_ip":"10.0.2.22","url":"http://phish-lab.fake/payload.bin","action":"block","category":"malware"}
{"ts":"2026-08-22T03:10:00Z","user":"carol","src_ip":"10.0.2.30","url":"https://update.microsoft.com","action":"allow","category":"software-update"}
{"ts":"2026-08-22T03:12:33Z","user":"jsmith","src_ip":"10.0.5.88","url":"http://203.0.113.99/c2-beacon","action":"block","category":"command-and-control"}
EOF

Command — copy this

jq -c 'select(.action=="block")' "$SOC_LAB/logs/proxy.jsonl"
grep phishing "$SOC_LAB/logs/proxy.jsonl"

Primary tools to practice this lesson: jq, grep. Reference sites: Proxy log analysis (https://attack.mitre.org/techniques/T1566/); MITRE T1071 (https://attack.mitre.org/techniques/T1071/); Splunk web logs (https://docs.splunk.com/Documentation/Splunk/latest/Data/Howtomonitorproxyserverlogs). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why correlation beats single-source panic

One deny log is noise — proxy deny + 4625 + rare DNS on same lab host raises triage priority. L1 documents timeline on fictional asset before escalation.

Defenders tune category feeds and blocklists — students name fields, not run live phishing campaigns.

3. Literacy ≠ sending real malware links

Forbidden: emailing phishing links to classmates or live users 'for detection.' Allowed: network card — three log types, correlation sketch on $SOC_LAB timeline.

Ship: network/proxy correlation sketch for YOUR lab. Next: Sources Lab.

4. What you ship: network/proxy correlation sketch for $SOC_LAB

DNS, proxy, firewall fields and timeline sketch. $SOC_LAB named. NO live phishing. chmod 600.

5. What you record before the next lesson

Date. Network card. $SOC_LAB named. File t29-m04-l03-network-proxy-logs.txt chmod 600.

6. Wrong vs right: stranger SIEM vs YOUR sample logs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Send real malware URL to generate proxy logs. Import employer proxy export without ticket.
Right: Write network/proxy correlation sketch for YOUR $SOC_LAB samples. Next: Sources Lab.

Hands-on Exercise