Lab Telemetry Only

Lab telemetry only means YOUR synthetic auth jsonl, process, and proxy samples under $HUNT_LAB — document sample IDs in notes before any hunt-style query run.

Lab Telemetry Only• Audio Walkthrough

00:00/03:34

Visual · t30_lab_telemetry_only

Lab telemetry literacy. $HUNT_LAB only. Original Cyberlium.

The jsonl file is part of scope — Cyberlium refuses hunt work on datasets and tenants you do not own or lack written permission to analyze.

Lab telemetry is jsonl or text YOU generated, a courseware hunt pack labeled for training, or a Cyberlium synthetic auth/process sample shipped for Topic 30. Intentional suspicious patterns live in $HUNT_LAB only — never copied from production exports without authorization. Cyberlium maps allowed samples on YOUR $HUNT_LAB inventory — file name, source, owner — never 'borrowed' employer Splunk exports or scraped victim dumps. Next: No Offensive Playbooks.

1. Allowed lab surfaces (named)

Self-authored auth jsonl with fake usernames and IPs. Course process telemetry snippets with labeled TTP context. Proxy jsonl with synthetic URLs. Cyberlium t30-hunt packs with explicit training labels.

On $HUNT_LAB, list telemetry type, source file, and owner — fictional hostnames OK if labeled sample.

Command guide

Try these commands — Allowed lab surfaces (named)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: grep, curl. Reference sites: Elastic Security (https://www.elastic.co/guide/en/security/current/index.html); Splunk docs (https://docs.splunk.com/Documentation/Splunk/latest); Sigma (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why telemetry scope matters before hunts

Splunk, Elastic, and jq are powerful on any dataset — scope is what keeps practice legal and ethical. Production SIEM exports, stranger cloud tenants, and scraped breach dumps are out of scope.

If you cannot answer 'who owns this telemetry and who approved analysis?', pause and fix scope notes before running hunt searches.

3. Telemetry inventory habit

Forbidden: using a trending breach jsonl dump because it 'looks like training.' Allowed: telemetry card — type, source, owner, allowed operations (search YOUR auth jsonl, count failed logins only).

Ship: telemetry inventory row for one $HUNT_LAB sample. Next: No Offensive Playbooks.

4. What you ship: lab telemetry inventory row for $HUNT_LAB

Telemetry type, source, owner, allowed ops. $HUNT_LAB named. NEVER production exports. chmod 600.

5. What you record before the next lesson

Date. Telemetry inventory row. $HUNT_LAB named. File t30-m01-l02-lab-telemetry-only.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Import employer Splunk export because lab telemetry is boring. Skip telemetry card because 'it's just jq.'
Right: Write telemetry inventory row for YOUR $HUNT_LAB sample. Next: No Offensive Playbooks.

Hands-on Exercise