SOC › Module 3 › Lesson 1
SIEM Job
SIEM job literacy names ingest, parse, index, search, and alert — map the pipeline on YOUR $SOC_LAB sample JSON before any live cluster login.
Visual · t29_siem_job
SIEM pipeline literacy. $SOC_LAB only. Original Cyberlium.
Opening
Logs arrive raw — SIEM makes them searchable — literacy names the pipeline, not stranger-tenant admin keys.
A SIEM collects logs from agents and forwarders, parses timestamps and fields, indexes for fast search, runs detection rules, and surfaces alerts to analysts. Data models, retention, and parsing quality determine whether L1 searches succeed or fail silently. Cyberlium maps SIEM pipeline stages on YOUR $SOC_LAB sample files — jq or text search on local JSON counts as lab SIEM practice. Next: Splunk/Elastic Named.
1. SIEM pipeline (named)
Ingest: agents, syslog, API collectors. Parse: extract username, IP, action fields. Index: time-series storage for search. Detect: rules, ML, correlation. Alert: queue item for L1 triage.
On $SOC_LAB, label pipeline stage for one auth-failure line in YOUR sample file.
Command guide
Try these commands — SIEM pipeline (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
jq manual — https://jqlang.github.io/jq/manual/ (JSON filter literacy)
Elastic KQL — https://www.elastic.co/guide/en/security/current/kuery-query-language.html Splunk SPL — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/logs/auth.jsonl" <<'EOF'
{"ts":"2026-08-22T02:14:33Z","event_id":4625,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.5.88","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T02:14:35Z","event_id":4625,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.5.88","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T02:14:38Z","event_id":4625,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.5.88","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T02:15:01Z","event_id":4624,"host":"WIN-LAB01","user":"jsmith","src_ip":"10.0.2.10","result":"success","reason":"interactive logon"}
{"ts":"2026-08-22T02:16:12Z","event_id":4625,"host":"WIN-LAB01","user":"administrator","src_ip":"203.0.113.50","result":"failure","reason":"unknown user"}
{"ts":"2026-08-22T02:16:15Z","event_id":4625,"host":"WIN-LAB01","user":"administrator","src_ip":"203.0.113.50","result":"failure","reason":"bad password"}
{"ts":"2026-08-22T03:00:00Z","event_id":4624,"host":"WIN-LAB02","user":"alice","src_ip":"10.0.2.15","result":"success","reason":"network logon"}
EOFCommand — copy this
echo 'Seeded auth.jsonl — FAKE Windows-style events for YOUR lab' jq -c 'select(.event_id==4625)' "$SOC_LAB/logs/auth.jsonl"
Primary tools to practice this lesson: jq, python3. Reference sites: jq manual (https://jqlang.github.io/jq/manual/); Elastic KQL (https://www.elastic.co/guide/en/security/current/kuery-query-language.html); Splunk SPL (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why parsing matters for L1
Bad timestamps break correlation. Missing fields make rules noisy. L1 who understands 'ingest vs search' asks better questions on escalation — 'was WinEventLog forwarded?' not random keyword guesses.
Defenders monitor ingest lag and parsing errors — students note field names on lab samples.
3. Lab boundary
Forbidden: claiming SIEM admin on production without role. Allowed: pipeline card — five stages with $SOC_LAB sample field example.
Ship: SIEM pipeline card for YOUR lab log. Next: Splunk/Elastic Named.
4. What you ship: SIEM pipeline card for $SOC_LAB
Five pipeline stages with sample field. $SOC_LAB named. NO live cluster admin. chmod 600.
5. What you record before the next lesson
Date. Pipeline card. $SOC_LAB named. File t29-m03-l01-siem-job.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume all logs auto-parse perfectly. Request admin keys for stranger tenant.
Right
Write SIEM pipeline card for YOUR $SOC_LAB sample. Next: Splunk/Elastic Named.
Mission: map SIEM pipeline on YOUR lab log
1) Name five pipeline stages. 2) Cite one field from YOUR sample. 3) Note one parse failure symptom. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Search fails often because of time zone or field name — check parsing first.
Knowledge Check
APPLY: SIEM pipeline includes:
Multiple choice
Knowledge Check
APPLY: True or False: Bad timestamps can break log correlation.
True or False
Knowledge Check
APPLY: SIEM job literacy on Cyberlium uses:
Multiple choice