SOC › Module 3 › Lesson 3
Query Literacy
Query literacy names conceptual SPL, KQL, and jq patterns on YOUR $SOC_LAB sample JSON — filter, time bound, count — no production cluster required.
Visual · t29_query_literacy
Query literacy. $SOC_LAB only. Original Cyberlium.
Opening
index=auth failure | stats count — literacy reads the intent on lab files before you paste SPL into stranger Splunk.
Analyst queries follow patterns: constrain time, filter field values, project fields, aggregate counts, sort rare events. SPL example (conceptual): index=winauth EventCode=4625 | stats count by Account_Name. KQL example (conceptual): SecurityEvent | where EventID == 4625 | summarize count() by Account. jq example (lab file): select(.event_id==4625) | group_by(.user) on YOUR JSON. Cyberlium practices query intent on $SOC_LAB — run jq locally on sample files; write SPL/KQL on paper mapped to same intent. Next: SIEM Lab.
1. Query patterns (named, conceptual)
Time bound: last 1h, earliest=-24h@h. Field filter: status=failure, action=deny. Aggregate: count, dc(user), rare values. Sort/limit: top 10 sources. jq on lab JSON:[] | select(.outcome=="failure") for offline practice.
On $SOC_LAB, write one conceptual SPL, one KQL, and one jq line targeting failed auth on YOUR sample — do not need live cluster.
Command guide
Try these commands — Query patterns (named, conceptual)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Rare IP detection — https://attack.mitre.org/techniques/T1078/ (valid accounts abuse) Splunk stats — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats Sigma correlation — https://sigmahq.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
jq -c 'select(.result=="failure") | .src_ip' "$SOC_LAB/logs/auth.jsonl" | sort | uniq -c | sort -rn
python3 - <<'PY'
import json, collections, os
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
path = os.path.join(lab, 'logs', 'auth.jsonl')
fails = [json.loads(l) for l in open(path) if json.loads(l).get('result')=='failure']
by_ip = collections.Counter(e['src_ip'] for e in fails)
print('SIEM-style rare IP check (YOUR lab):')
for ip, n in by_ip.most_common(): print(f' {ip}: {n} failures')
PYPrimary tools to practice this lesson: jq, python3. Reference sites: Rare IP detection (https://attack.mitre.org/techniques/T1078/); Splunk stats (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats); Sigma correlation (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why conceptual beats copy-paste
Field names differ per org — L1 who understands intent adapts queries. Copy-paste from blogs without time bounds creates missed alerts and performance incidents.
Defenders document standard queries in runbooks — students mirror runbook structure on lab notes.
3. Ethics: lab files only
Forbidden: running brute-force or exploit queries against production login APIs 'to test detection.' Allowed: query intent card — three languages, same question, $SOC_LAB filename.
Ship: query intent card for failed-auth question on YOUR lab. Next: SIEM Lab.
4. What you ship: query intent card for $SOC_LAB
Conceptual SPL, KQL, jq for same lab question. $SOC_LAB named. NO prod queries. chmod 600.
5. What you record before the next lesson
Date. Query card. $SOC_LAB named. File t29-m03-l03-query-literacy.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run unbounded search on stranger index. Test brute force on live portal.
Right
Write query intent card for YOUR $SOC_LAB failed-auth sample. Next: SIEM Lab.
Mission: write three query forms for YOUR lab sample
1) Write conceptual SPL for failed auth count by user. 2) Write conceptual KQL equivalent. 3) Write jq filter on YOUR JSON file. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Same question, three syntaxes — that is transferable SIEM literacy.
Knowledge Check
APPLY: Good analyst queries start with:
Multiple choice
Knowledge Check
APPLY: True or False: jq on local $SOC_LAB JSON counts as lab SIEM practice.
True or False
Knowledge Check
APPLY: Query literacy on Cyberlium means:
Multiple choice