SOC › Module 1 › Lesson 3
No Stranger SIEM
No stranger SIEM means refuse production Splunk, Elastic, or Sentinel tenants you do not own — write the refusal habit into YOUR $SOC_LAB ethics card.
Visual · t29_no_stranger_siem
SIEM refusal. $SOC_LAB only. Original Cyberlium.
Opening
Leaked tokens, shadow IT dashboards, and live employer consoles — all stop outside authorized scope. Literacy names the tool; queries stay on lab samples.
Stranger SIEM access includes using leaked Splunk HEC tokens, browsing a former employer's Elastic cluster after offboarding, or running detection rules against a client's production tenant without written rules of engagement. Org scope follows ownership: finance, health, and SaaS log stores without ticket stay off limits. Cyberlium practices refusal sentences on YOUR $SOC_LAB — 'I analyze only sample logs and named literacy on lab files' — never copy forum threads that aim brute-force or exploit tooling at live services. Next: Lab Setup.
1. Unauthorized SIEM patterns (named, literacy only)
Stranger tenant: Splunk/Elastic/Sentinel instance you lack authorization to query — defender fix is RBAC, MFA, and token rotation. Named for literacy — NOT queried on Cyberlium regardless of tool familiarity.
On $SOC_LAB, write three refusal triggers — e.g., unknown tenant owner, production employer cluster without ticket, no written scope for live log export.
Command guide
Try these commands — Unauthorized SIEM patterns (named, literacy only)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/tactics/TA0001/ (initial access detection context) FIRST — https://www.first.org/global-society/teams (CSIRT roles literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/notes/no-unauthorized-siem.txt" <<'EOF'
SCOPE: YOUR lab folder $HOME/cyberlium-lab/t29-soc/ — FAKE seeded logs only
NEVER: dump real corp SIEM without authorization, attack stranger networks
NEVER: phishing kits, malware payloads, hydra/brute-force against live targets
ALLOWED: jq/python3 on YOUR auth.jsonl/proxy.jsonl/alerts.json, curl public docs
PURPOSE: SOC Level 1 detection literacy — triage and document, not offensive ops
EOFCommand — copy this
grep -E 'SCOPE|NEVER|ALLOWED' "$SOC_LAB/notes/no-unauthorized-siem.txt"
python3 -c "print('Ethics: unauthorized SIEM access = legal risk — YOUR lab logs only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/tactics/TA0001/); FIRST (https://www.first.org/global-society/teams). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why refusal protects you and others
Unauthorized access laws and employer policy apply to SIEM queries — skill without scope is career and legal risk. Victim data: production logs contain PII, credentials, and session tokens you must not exfiltrate.
Defenders enforce least privilege and audit search history — students practice the pause habit on lab scenarios and defender notes only.
3. Ethics card habit
Forbidden: querying stranger SIEM tenants, sharing live alert screenshots with customer names, importing victim PCAP without scope. Allowed: ethics card — allowed log samples, NEVER list, refusal sentence you will say aloud.
Ship: SOC ethics card with NEVER list and one refusal sentence. Next: Lab Setup.
4. What you ship: SOC ethics card for $SOC_LAB
Allowed logs, NEVER list, refusal sentence. $SOC_LAB named. NO stranger SIEM. chmod 600.
5. What you record before the next lesson
Date. Ethics card. $SOC_LAB named. File t29-m01-l03-no-stranger-siem.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use leaked Splunk token to 'practice SPL.' Share live alert queue screenshots in Discord.
Right
Write SOC ethics card for YOUR $SOC_LAB. Next: Lab Setup.
Mission: write YOUR SIEM refusal habit
1) List three NEVER targets (stranger SIEM, production exports, unauthorized brute scripts). 2) Write one refusal sentence for live-tenant query requests. 3) Name allowed $SOC_LAB surfaces. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
When in doubt, stop and ask scope owner — lab habit beats expulsion guesses.
Knowledge Check
APPLY: No stranger SIEM on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger SIEM is taught as a named risk class with defender notes — not as live-tenant query practice.
True or False
Knowledge Check
APPLY: Discord link to leaked Splunk token for finance tenant — you:
Multiple choice