SPL Literacy

SPL literacy names Splunk search patterns — time bounds, field filters, stats, transaction — mapped on YOUR $HUNT_LAB hunt intent before live cluster login.

SPL Literacy• Audio Walkthrough

00:00/03:24

Visual · t30_spl_literacy

SPL literacy. $HUNT_LAB only. Original Cyberlium.

SPL pipes transform results — literacy reads hunt intent on lab notes before you paste searches into stranger Splunk.

Advanced SPL patterns for L2 hunts: time modifiers (earliest, latest), field filters, stats/timechart/chart aggregations, transaction for session grouping, join/subsearch for correlation (conceptual). Example literacy: index=winauth EventCode=4625 earliest=-1h | stats count by src_ip | where count>10 — mapped to YOUR auth jsonl intent. Cyberlium names SPL on YOUR $HUNT_LAB — write on paper or map to jq; never query stranger indexes. Next: ELK Literacy.

1. SPL hunt patterns (named, conceptual)

Time: earliest=-24h@h latest=now. Filter: index=auth action=failure. Aggregate: stats count, dc(user), rare values. Session: transaction start/end on lab fictional session ID. Correlation: subsearch pattern — literacy only on paper.

On $HUNT_LAB, write three SPL lines (conceptual) for one hunt hypothesis — time bound required.

Command guide

Try these commands — SPL hunt patterns (named, conceptual)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: grep, curl. Reference sites: Splunk SPL (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual); Splunk stats (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why SPL literacy helps L2 escalations

L2 reads L1 and hunt saved searches — understanding stats vs transaction prevents misread results. Performance: unbounded SPL melts clusters — time and index scope first.

Students map SPL intent to lab jsonl jq equivalent — transferable skill without stranger tenant.

3. Literacy ≠ stranger Splunk abuse

Forbidden: leaked Splunk token hunts on production finance index. Allowed: SPL literacy card — five patterns with $HUNT_LAB hunt question mapping.

Ship: SPL literacy card for YOUR lab hunt intent. Next: ELK Literacy.

4. What you ship: SPL literacy card for $HUNT_LAB

Five conceptual SPL patterns mapped to hunt question. $HUNT_LAB named. NO stranger cluster. chmod 600.

5. What you record before the next lesson

Date. SPL card. $HUNT_LAB named. File t30-m04-l01-spl-literacy.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Run unbounded SPL on stranger index. Skip time modifier in every example.
Right: Write SPL literacy card for YOUR $HUNT_LAB hunt intent. Next: ELK Literacy.

Hands-on Exercise