Lab Logs Only
Lab logs only means YOUR synthetic auth, syslog, and proxy samples under $SOC_LAB — document sample IDs in notes before any SIEM-style query run.
Visual · t29_lab_logs_only
Lab log literacy. $SOC_LAB only. Original Cyberlium.
The log file is part of scope — Cyberlium refuses SIEM work on datasets and tenants you do not own or lack written permission to analyze.
A lab log is JSON or text YOU generated, a courseware alert pack labeled for training, or a Cyberlium synthetic auth/proxy sample shipped for Topic 29. Intentional suspicious patterns live in $SOC_LAB only — never copied from production exports without authorization. Cyberlium maps allowed samples on YOUR $SOC_LAB inventory — file name, source, owner — never 'borrowed' employer Splunk exports or scraped victim dumps. Next: No Stranger SIEM.
1. Allowed lab surfaces (named)
Self-authored Windows Event ID 4625/4624 samples. Course syslog snippets with fake usernames. Proxy JSON with synthetic URLs and IPs. Cyberlium t29-soc packs with explicit training labels.
On $SOC_LAB, list log type, source file, and owner — fictional hostnames OK if labeled sample.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: Elastic Security (https://www.elastic.co/guide/en/security/current/index.html); Splunk docs (https://docs.splunk.com/Documentation/Splunk/latest); Sigma GitHub (https://github.com/SigmaHQ/sigma). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why log scope matters before queries
Splunk, Elastic, and jq are powerful on any dataset — scope is what keeps practice legal and ethical. Production SIEM exports, stranger cloud tenants, and scraped breach dumps are out of scope.
If you cannot answer 'who owns this log and who approved analysis?', pause and fix scope notes before running searches.
3. Log inventory habit
Forbidden: using a trending breach log dump because it 'looks like training.' Allowed: log card — type, source, owner, allowed operations (search YOUR auth sample, count failed logins only).
Ship: log inventory row for one $SOC_LAB sample. Next: No Stranger SIEM.
4. What you ship: lab log inventory row for $SOC_LAB
Log type, source, owner, allowed ops. $SOC_LAB named. NEVER production exports. chmod 600.
5. What you record before the next lesson
Date. Log inventory row. $SOC_LAB named. File t29-m01-l02-lab-logs-only.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Import employer Splunk export because lab logs are boring. Skip log card because 'it's just jq.'
- Right: Write log inventory row for YOUR $SOC_LAB sample. Next: No Stranger SIEM.
Mission: document YOUR SOC lab log sample
1) Name one self-authored or course log sample. 2) Record source and owner. 3) List two allowed operations on that sample. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Self-authored synthetic logs beat irreversible mistakes on production PII exports.
APPLY: Lab logs only on Cyberlium means:
APPLY: True or False: Searching failed-login patterns on logs YOU authored is acceptable lab practice.
APPLY: Before running a SIEM-style query you should: