SOC › Module 3 › Lesson 2
Splunk Elastic Named
Splunk and Elastic literacy names products, index/data stream concepts, and analyst search entry points — vocabulary on YOUR $SOC_LAB before live license keys.
Visual · t29_splunk_elastic_named
Splunk/Elastic literacy. $SOC_LAB only. Original Cyberlium.
Opening
Splunk speaks SPL and indexes — Elastic speaks KQL and data streams — literacy names both without logging into stranger clusters.
Splunk Enterprise/Cloud uses indexes, sourcetypes, and SPL (Search Processing Language) for pipe-based queries. Elastic Stack (Elasticsearch, Kibana) uses data streams, indices, and KQL/Lucene for search. Microsoft Sentinel adds KQL on Log Analytics — same literacy pattern: time bound, field filter, aggregate. Cyberlium names vendor vocabulary on YOUR $SOC_LAB — map 'index vs data stream' and 'sourcetype vs event.category' on sample JSON filenames only. Next: Query Literacy.
1. Vendor concepts (named)
Splunk: index, sourcetype, host, source, SPL stats/timechart. Elastic: index or data stream, ECS fields, KQL from Kibana Discover. Both: time picker, field sidebar, saved searches, detection rules — literacy names, lab files substitute for cluster.
On $SOC_LAB, write which vendor term maps to 'folder for auth logs' in each stack.
Command guide
Try these commands — Vendor concepts (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma failed logon — https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security MITRE T1110 — https://attack.mitre.org/techniques/T1110/ (brute force detection literacy) Elastic winlog — https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
jq -c 'select(.result=="failure") | {user, src_ip, ts}' "$SOC_LAB/logs/auth.jsonl"
jq -s 'group_by(.src_ip) | map({src_ip: .[0].src_ip, fail_count: length}) | .[]' <(jq -c 'select(.result=="failure")' "$SOC_LAB/logs/auth.jsonl")
grep -E '4625|failure' "$SOC_LAB/logs/auth.jsonl" | wc -lPrimary tools to practice this lesson: jq, grep. Reference sites: Sigma failed logon (https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security); MITRE T1110 (https://attack.mitre.org/techniques/T1110/); Elastic winlog (https://www.elastic.co/guide/en/security/current/prebuilt-rules.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why vendor literacy helps hiring
Job posts name Splunk or Elastic — interviews ask how you would find failed logins in last hour. Conceptual answers from lab samples transfer — unauthorized tenant access does not.
Defenders standardize field names (ECS, CIM) — students compare lab JSON keys to vendor docs.
3. Literacy ≠ stranger license abuse
Forbidden: spinning trial tenants on employer data, sharing Splunk license keys, querying Elastic Cloud you do not own. Allowed: vendor card — three Splunk terms, three Elastic terms, $SOC_LAB file mapping.
Ship: Splunk/Elastic vocabulary card for YOUR lab. Next: Query Literacy.
4. What you ship: Splunk/Elastic vocabulary card for $SOC_LAB
Three terms per vendor mapped to lab file. $SOC_LAB named. NO stranger cluster. chmod 600.
5. What you record before the next lesson
Date. Vendor card. $SOC_LAB named. File t29-m03-l02-splunk-elastic-named.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Memorize SPL without knowing time bounds. Use leaked Elastic API key for practice.
Right
Write Splunk/Elastic vocabulary card for YOUR $SOC_LAB files. Next: Query Literacy.
Mission: name vendor terms on YOUR lab files
1) Define index and sourcetype in one sentence each. 2) Define data stream and KQL entry point. 3) Map lab auth file to both vocabularies. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Time range first — unbounded search is how analysts melt clusters and careers.
Knowledge Check
APPLY: Splunk uses which query language:
Multiple choice
Knowledge Check
APPLY: True or False: Elastic Kibana Discover uses KQL for search entry.
True or False
Knowledge Check
APPLY: Vendor literacy on Cyberlium avoids:
Multiple choice