SIEM Job

SIEM job literacy names ingest, parse, index, search, and alert — map the pipeline on YOUR $SOC_LAB sample JSON before any live cluster login.

SIEM Job• Audio Walkthrough

00:00/03:21

Visual · t29_siem_job

SIEM pipeline literacy. $SOC_LAB only. Original Cyberlium.

Logs arrive raw — SIEM makes them searchable — literacy names the pipeline, not stranger-tenant admin keys.

A SIEM collects logs from agents and forwarders, parses timestamps and fields, indexes for fast search, runs detection rules, and surfaces alerts to analysts. Data models, retention, and parsing quality determine whether L1 searches succeed or fail silently. Cyberlium maps SIEM pipeline stages on YOUR $SOC_LAB sample files — jq or text search on local JSON counts as lab SIEM practice. Next: Splunk/Elastic Named.

1. SIEM pipeline (named)

Ingest: agents, syslog, API collectors. Parse: extract username, IP, action fields. Index: time-series storage for search. Detect: rules, ML, correlation. Alert: queue item for L1 triage.

On $SOC_LAB, label pipeline stage for one auth-failure line in YOUR sample file.

Command guide

Try these commands — SIEM pipeline (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Optional command

jq manual — https://jqlang.github.io/jq/manual/ (JSON filter literacy)

Elastic KQL — https://www.elastic.co/guide/en/security/current/kuery-query-language.html Splunk SPL — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq
sudo apt install python3

macOS:

Command — copy this

brew install jq
brew install python3

Windows:

Command — copy this

choco install jq

Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/logs/auth.jsonl" <<'EOF'
{"ts":"2026-08-22T02:14:33Z","event_id":4625,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.5.88","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T02:14:35Z","event_id":4625,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.5.88","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T02:14:38Z","event_id":4625,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.5.88","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T02:15:01Z","event_id":4624,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.2.10","result":"success","reason":"interactive logon"}
{"ts":"2026-08-22T02:16:12Z","event_id":4625,"host":"WIN-LAB01","user":"administrator","src_ip":"203.0.113.50","result":"failure","reason":"unknown user"}
{"ts":"2026-08-22T02:16:15Z","event_id":4625,"host":"WIN-LAB01","user":"administrator","src_ip":"203.0.113.50","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T03:00:00Z","event_id":4624,"host":"WIN-LAB02","user":"alice","src_ip":"10.0.2.15","result":"success","reason":"network logon"}
EOF

Command — copy this

echo 'Seeded auth.jsonl — FAKE Windows-style events for YOUR lab'
jq -c 'select(.event_id==4625)' "$SOC_LAB/logs/auth.jsonl"

Primary tools to practice this lesson: jq, python3. Reference sites: jq manual (https://jqlang.github.io/jq/manual/); Elastic KQL (https://www.elastic.co/guide/en/security/current/kuery-query-language.html); Splunk SPL (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why parsing matters for L1

Bad timestamps break correlation. Missing fields make rules noisy. L1 who understands 'ingest vs search' asks better questions on escalation — 'was WinEventLog forwarded?' not random keyword guesses.

Defenders monitor ingest lag and parsing errors — students note field names on lab samples.

3. Lab boundary

Forbidden: claiming SIEM admin on production without role. Allowed: pipeline card — five stages with $SOC_LAB sample field example.

Ship: SIEM pipeline card for YOUR lab log. Next: Splunk/Elastic Named.

4. What you ship: SIEM pipeline card for $SOC_LAB

Five pipeline stages with sample field. $SOC_LAB named. NO live cluster admin. chmod 600.

5. What you record before the next lesson

Date. Pipeline card. $SOC_LAB named. File t29-m03-l01-siem-job.txt chmod 600.

6. Wrong vs right: stranger SIEM vs YOUR sample logs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Assume all logs auto-parse perfectly. Request admin keys for stranger tenant.
Right: Write SIEM pipeline card for YOUR $SOC_LAB sample. Next: Splunk/Elastic Named.

Hands-on Exercise