SOC › Module 4 › Lesson 4
Lab — Sources
Pack Windows, Linux, and network/proxy cards — log sources file from $SOC_LAB only.
Visual · t29_sources_lab
Lab: sources pack. $SOC_LAB only. Original Cyberlium.
Opening
Sources pack merges auth to syslog to proxy — paperwork before detection rules module.
Lessons 4-1–4-3 named Windows auth, Linux auth, and network/proxy fields. This lab merges three source cards plus one cross-source timeline on $SOC_LAB samples. No live server or network access — source literacy paperwork only. Next: Quiz — Log Sources.
1. Lab contract: sources pack
Create $HOME/cyberlium-lab/t29-m04-l04-sources-lab.txt merging Windows, Linux, and network sections with unified timeline on fictional lab host and M1 ethics cross-reference.
Optional: paste three redacted log lines — one per source — from YOUR samples.
Command guide
Try these commands — Lab contract: sources pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Log correlation — https://attack.mitre.org/ (multi-source detection literacy) Elastic correlation — https://www.elastic.co/guide/en/security/current/rules-ui.html NIST IR — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
echo '=== Correlate: auth failures from 10.0.5.88 + proxy blocks for jsmith ==='
jq -c 'select(.user=="jsmith" and .result=="failure")' "$SOC_LAB/logs/auth.jsonl"
jq -c 'select(.user=="jsmith" and .action=="block")' "$SOC_LAB/logs/proxy.jsonl"
cat > "$SOC_LAB/notes/log-parse-summary.txt" <<'EOF'
YOUR lab log parse summary:
Windows auth.jsonl: 4625 failures from 10.0.5.88 (jsmith) + 203.0.113.50 (administrator)
linux-auth.sample: Failed password from 203.0.113.77
proxy.jsonl: blocks for phishing, malware, C2 categories
correlate user+IP across sources — FAKE data only
EOFCommand — copy this
grep -E 'Windows|proxy|FAKE' "$SOC_LAB/notes/log-parse-summary.txt"
═══ WINDOWS ═══
Command — copy this
findstr "failure" $HOME/cyberlium-lab/t29-soc/logs/auth.jsonl findstr "block" $HOME/cyberlium-lab/t29-soc/logs/proxy.jsonl
Primary tools to practice this lesson: jq, grep. Reference sites: Log correlation (https://attack.mitre.org/); Elastic correlation (https://www.elastic.co/guide/en/security/current/rules-ui.html); NIST IR (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal boundaries
Grep for production hostnames, real employee names, live public IPs — redact or replace with fictional labels. Sources pack stays training-only.
Confirm brute-force and phishing references are detection literacy on fake logs only.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Rule Anatomy.
Log source literacy feeds detection rule lessons in M5.
4. What you ship: log sources pack for $SOC_LAB
Merged Windows, Linux, network cards plus timeline. $SOC_LAB named. NO live scanning. chmod 600.
5. What you record before the next lesson
Date. Sources pack path. $SOC_LAB named. File t29-m04-l04-sources-lab.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include production auth.log export in pack. Skip cross-source timeline.
Right
Write YOUR log sources pack for $SOC_LAB. chmod 600. Next: Quiz — Log Sources.
Mission: freeze YOUR log sources pack
1) Merge M4 source cards. 2) Add unified timeline on fictional host. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One timeline across three sources — that is how L1 proves correlation skill.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Sources pack should include cross-source timeline on fictional host.
True or False
Knowledge Check
APPLY: Malware/phishing references in sources pack are:
Multiple choice