SOC › Module 4 › Lesson 3
Network Proxy Logs
Network and proxy literacy names DNS, firewall, and web proxy fields — correlate suspicious domains on YOUR $SOC_LAB proxy JSON only.
Visual · t29_network_proxy_logs
Network/proxy literacy. $SOC_LAB only. Original Cyberlium.
Opening
Proxy saw the URL — DNS saw the lookup — literacy ties network fields to auth failures on lab timelines.
Network telemetry includes firewall allow/deny, DNS queries (query name, response code), proxy logs (URL, action, user, category), and NetFlow connection metadata. Phishing and malware literacy maps suspicious URL + rare domain + auth failure sequence on synthetic timelines — detection context only, no exploit delivery. Cyberlium maps proxy/DNS fields on YOUR $SOC_LAB JSON — fictional URLs and IPs. Next: Sources Lab.
1. Network log types (named)
DNS: query, answer, client IP — detect rare NXDOMAIN bursts or DGA-like patterns on lab data. Proxy: url, action (allow/deny), bytes, user-agent — detect suspicious categories. Firewall: src/dst IP, port, action — correlate with auth failures.
On $SOC_LAB, list four fields from one proxy JSON line in YOUR sample.
Command guide
Try these commands — Network log types (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Proxy log analysis — https://attack.mitre.org/techniques/T1566/ (phishing via proxy context) MITRE T1071 — https://attack.mitre.org/techniques/T1071/ (application layer protocol) Splunk web logs — https://docs.splunk.com/Documentation/Splunk/latest/Data/Howtomonitorproxyserverlogs
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/logs/proxy.jsonl" <<'EOF'
{"ts":"2026-08-22T03:01:12Z","user":"alice","src_ip":"10.0.2.15","url":"https://docs.example.com","action":"allow","category":"business"}
{"ts":"2026-08-22T03:05:44Z","user":"bob","src_ip":"10.0.2.22","url":"http://phish-lab.fake/login","action":"block","category":"phishing"}
{"ts":"2026-08-22T03:06:01Z","user":"bob","src_ip":"10.0.2.22","url":"http://phish-lab.fake/payload.bin","action":"block","category":"malware"}
{"ts":"2026-08-22T03:10:00Z","user":"carol","src_ip":"10.0.2.30","url":"https://update.microsoft.com","action":"allow","category":"software-update"}
{"ts":"2026-08-22T03:12:33Z","user":"jsmith","src_ip":"10.0.5.88","url":"http://203.0.113.99/c2-beacon","action":"block","category":"command-and-control"}
EOFCommand — copy this
jq -c 'select(.action=="block")' "$SOC_LAB/logs/proxy.jsonl" grep phishing "$SOC_LAB/logs/proxy.jsonl"
Primary tools to practice this lesson: jq, grep. Reference sites: Proxy log analysis (https://attack.mitre.org/techniques/T1566/); MITRE T1071 (https://attack.mitre.org/techniques/T1071/); Splunk web logs (https://docs.splunk.com/Documentation/Splunk/latest/Data/Howtomonitorproxyserverlogs). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why correlation beats single-source panic
One deny log is noise — proxy deny + 4625 + rare DNS on same lab host raises triage priority. L1 documents timeline on fictional asset before escalation.
Defenders tune category feeds and blocklists — students name fields, not run live phishing campaigns.
3. Literacy ≠ sending real malware links
Forbidden: emailing phishing links to classmates or live users 'for detection.' Allowed: network card — three log types, correlation sketch on $SOC_LAB timeline.
Ship: network/proxy correlation sketch for YOUR lab. Next: Sources Lab.
4. What you ship: network/proxy correlation sketch for $SOC_LAB
DNS, proxy, firewall fields and timeline sketch. $SOC_LAB named. NO live phishing. chmod 600.
5. What you record before the next lesson
Date. Network card. $SOC_LAB named. File t29-m04-l03-network-proxy-logs.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Send real malware URL to generate proxy logs. Import employer proxy export without ticket.
Right
Write network/proxy correlation sketch for YOUR $SOC_LAB samples. Next: Sources Lab.
Mission: sketch correlation on YOUR lab timeline
1) Name three network log types. 2) List four proxy fields from sample. 3) Sketch 3-event timeline on fictional host. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Timestamps aligned to UTC — correlation breaks when sources use local time silently.
Knowledge Check
APPLY: Proxy logs commonly include:
Multiple choice
Knowledge Check
APPLY: True or False: Correlating DNS, proxy, and auth on a timeline improves triage.
True or False
Knowledge Check
APPLY: Phishing detection literacy on Cyberlium means:
Multiple choice