Query Literacy

Query literacy names conceptual SPL, KQL, and jq patterns on YOUR $SOC_LAB sample JSON — filter, time bound, count — no production cluster required.

Query Literacy• Audio Walkthrough

00:00/03:33

Visual · t29_query_literacy

Query literacy. $SOC_LAB only. Original Cyberlium.

index=auth failure | stats count — literacy reads the intent on lab files before you paste SPL into stranger Splunk.

Analyst queries follow patterns: constrain time, filter field values, project fields, aggregate counts, sort rare events. SPL example (conceptual): index=winauth EventCode=4625 | stats count by Account_Name. KQL example (conceptual): SecurityEvent | where EventID == 4625 | summarize count() by Account. jq example (lab file): select(.event_id==4625) | group_by(.user) on YOUR JSON. Cyberlium practices query intent on $SOC_LAB — run jq locally on sample files; write SPL/KQL on paper mapped to same intent. Next: SIEM Lab.

1. Query patterns (named, conceptual)

Time bound: last 1h, earliest=-24h@h. Field filter: status=failure, action=deny. Aggregate: count, dc(user), rare values. Sort/limit: top 10 sources. jq on lab JSON:[] | select(.outcome=="failure") for offline practice.

On $SOC_LAB, write one conceptual SPL, one KQL, and one jq line targeting failed auth on YOUR sample — do not need live cluster.

Command guide

Try these commands — Query patterns (named, conceptual)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: jq, python3. Reference sites: Rare IP detection (https://attack.mitre.org/techniques/T1078/); Splunk stats (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats); Sigma correlation (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why conceptual beats copy-paste

Field names differ per org — L1 who understands intent adapts queries. Copy-paste from blogs without time bounds creates missed alerts and performance incidents.

Defenders document standard queries in runbooks — students mirror runbook structure on lab notes.

3. Ethics: lab files only

Forbidden: running brute-force or exploit queries against production login APIs 'to test detection.' Allowed: query intent card — three languages, same question, $SOC_LAB filename.

Ship: query intent card for failed-auth question on YOUR lab. Next: SIEM Lab.

4. What you ship: query intent card for $SOC_LAB

Conceptual SPL, KQL, jq for same lab question. $SOC_LAB named. NO prod queries. chmod 600.

5. What you record before the next lesson

Date. Query card. $SOC_LAB named. File t29-m03-l03-query-literacy.txt chmod 600.

6. Wrong vs right: stranger SIEM vs YOUR sample logs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Run unbounded search on stranger index. Test brute force on live portal.
Right: Write query intent card for YOUR $SOC_LAB failed-auth sample. Next: SIEM Lab.

Hands-on Exercise