SOC › Module 1 › Lesson 2
Lab Logs Only
Lab logs only means YOUR synthetic auth, syslog, and proxy samples under $SOC_LAB — document sample IDs in notes before any SIEM-style query run.
Visual · t29_lab_logs_only
Lab log literacy. $SOC_LAB only. Original Cyberlium.
Opening
The log file is part of scope — Cyberlium refuses SIEM work on datasets and tenants you do not own or lack written permission to analyze.
A lab log is JSON or text YOU generated, a courseware alert pack labeled for training, or a Cyberlium synthetic auth/proxy sample shipped for Topic 29. Intentional suspicious patterns live in $SOC_LAB only — never copied from production exports without authorization. Cyberlium maps allowed samples on YOUR $SOC_LAB inventory — file name, source, owner — never 'borrowed' employer Splunk exports or scraped victim dumps. Next: No Stranger SIEM.
1. Allowed lab surfaces (named)
Self-authored Windows Event ID 4625/4624 samples. Course syslog snippets with fake usernames. Proxy JSON with synthetic URLs and IPs. Cyberlium t29-soc packs with explicit training labels.
On $SOC_LAB, list log type, source file, and owner — fictional hostnames OK if labeled sample.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Elastic Security — https://www.elastic.co/guide/en/security/current/index.html (SIEM literacy) Splunk docs — https://docs.splunk.com/Documentation/Splunk/latest (search/SPL context) Sigma GitHub — https://github.com/SigmaHQ/sigma (rule examples literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t29-soc/logs" "$HOME/cyberlium-lab/t29-soc/notes" "$HOME/cyberlium-lab/t29-soc/rules" "$HOME/cyberlium-lab/t29-soc/tickets" "$HOME/cyberlium-lab/t29-soc/handoff" cat > "$HOME/cyberlium-lab/t29-soc/lab.env" <<'EOF' export SOC_LAB=$HOME/cyberlium-lab/t29-soc export SOC_LAB_LOGS=$HOME/cyberlium-lab/t29-soc/logs export SOC_LAB_RULES=$HOME/cyberlium-lab/t29-soc/rules EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t29-soc/lab.env" grep -E 'SOC_LAB' "$HOME/cyberlium-lab/t29-soc/lab.env" curl -sS https://docs.splunk.com/Documentation/Splunk/latest | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: Elastic Security (https://www.elastic.co/guide/en/security/current/index.html); Splunk docs (https://docs.splunk.com/Documentation/Splunk/latest); Sigma GitHub (https://github.com/SigmaHQ/sigma). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why log scope matters before queries
Splunk, Elastic, and jq are powerful on any dataset — scope is what keeps practice legal and ethical. Production SIEM exports, stranger cloud tenants, and scraped breach dumps are out of scope.
If you cannot answer 'who owns this log and who approved analysis?', pause and fix scope notes before running searches.
3. Log inventory habit
Forbidden: using a trending breach log dump because it 'looks like training.' Allowed: log card — type, source, owner, allowed operations (search YOUR auth sample, count failed logins only).
Ship: log inventory row for one $SOC_LAB sample. Next: No Stranger SIEM.
4. What you ship: lab log inventory row for $SOC_LAB
Log type, source, owner, allowed ops. $SOC_LAB named. NEVER production exports. chmod 600.
5. What you record before the next lesson
Date. Log inventory row. $SOC_LAB named. File t29-m01-l02-lab-logs-only.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import employer Splunk export because lab logs are boring. Skip log card because 'it's just jq.'
Right
Write log inventory row for YOUR $SOC_LAB sample. Next: No Stranger SIEM.
Mission: document YOUR SOC lab log sample
1) Name one self-authored or course log sample. 2) Record source and owner. 3) List two allowed operations on that sample. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Self-authored synthetic logs beat irreversible mistakes on production PII exports.
Knowledge Check
APPLY: Lab logs only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Searching failed-login patterns on logs YOU authored is acceptable lab practice.
True or False
Knowledge Check
APPLY: Before running a SIEM-style query you should:
Multiple choice