SOC › Module 1 › Lesson 4
Lab — Setup
Pack SOC scope, log inventory, and ethics card — lab setup file only, dest $SOC_LAB.
Visual · t29_lab_setup
Lab: write SOC setup pack. $SOC_LAB only. Original Cyberlium.
Opening
Lab setup before Splunk-style queries — scope paperwork SOC mentors expect.
Lessons 1–3 defined why SOC L1 matters, lab logs only, and stranger-SIEM refusal. This lab ships the combined artifact: topic scope paragraph, log inventory row, and ethics card for $SOC_LAB under $HOME/cyberlium-lab/t29-soc/. No live tenant access required — scope and log paperwork first. Next: Quiz — SOC Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t29-m01-l04-lab-setup.txt with date, operator, $SOC_LAB log placeholder, literacy vs unauthorized SIEM paragraph, log inventory row, and ethics card.
Optional: one-line proof your t29-soc sample folder exists — still no production SIEM work required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RoE literacy — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Sigma — https://sigmahq.io/ Elastic guide — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/roe.txt" <<'EOF'
SOC_LAB=$HOME/cyberlium-lab/t29-soc
targets: YOUR seeded auth.jsonl, proxy.jsonl, alerts.json — FAKE events only
never: real corp SIEM dumps, stranger network attacks, phishing kits, malware, hydra
allowed: mkdir logs, jq/python3 filter, grep logs, curl sigmahq/elastic/splunk/MITRE docs
output: triage notes, sigma stubs, tickets, handoff markdown in lab folder
EOFCommand — copy this
chmod 600 "$SOC_LAB/roe.txt" grep -E 'SOC_LAB|never|allowed|targets' "$SOC_LAB/roe.txt" command -v jq >/dev/null && jq --version || echo 'jq not installed — install for JSONL SIEM-style queries'
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t29-soc/roe.txt | Select-String never
jq --version 2>$null; if (-not $?) { Write-Output 'Install jq for JSONL SIEM-style queries' }Primary tools to practice this lesson: grep, curl. Reference sites: RoE literacy (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Sigma (https://sigmahq.io/); Elastic guide (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'Splunk token,' production tenant hostnames, live alert IDs, or victim log dumps — redact or delete. Rewrite forum habits to $SOC_LAB placeholders before you copy workflows.
Classmates build their own setup packs for their $SOC_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then What is a SOC?
SOC mentors archive lab setup before first sample log search; you are practicing that habit early.
4. What you ship: SOC lab setup pack for $SOC_LAB
Setup pack: scope, log row, ethics card. $SOC_LAB named. NEVER stranger SIEM. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $SOC_LAB scope note. File t29-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and query unknown Splunk tenant. Add production cluster to approved list.
Right
Write YOUR lab setup pack for $SOC_LAB. chmod 600. Next: Quiz — SOC Mindset and Lab.
Mission: freeze YOUR lab setup pack on disk
1) Merge scope, log, ethics sections. 2) Name $SOC_LAB. 3) chmod 600. Never list production SIEM analysis as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps SOC work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on SOC lab notes.
True or False
Knowledge Check
APPLY: A tutorial queries live Splunk without scope. You:
Multiple choice