SOC › Module 4 › Lesson 2
ELK Literacy
ELK literacy names Elasticsearch indices, ECS fields, Kibana Discover, and detection rules — vocabulary on YOUR $HUNT_LAB before live Elastic Cloud login.
Visual · t30_elk_literacy
ELK literacy. $HUNT_LAB only. Original Cyberlium.
Opening
Elastic speaks ECS and KQL — literacy names the stack for hunt correlation on lab files without stranger cluster keys.
Elastic Stack (Elasticsearch, Kibana, Elastic Security) uses indices or data streams, ECS normalized fields (event.action, source.ip, user.name), KQL in Discover, and detection rules with EQL optional for sequence hunts. L2 hunts often pivot from Discover to Detection to Cases — literacy names the path. Cyberlium maps ELK vocabulary on YOUR $HUNT_LAB — compare jsonl keys to ECS field names conceptually. Next: KQL/jq Bridge.
1. ELK hunt concepts (named)
Index/data stream: where auth logs live. ECS: event.category, event.outcome, source.ip. KQL: event.outcome:failure and source.ip:10.0.0.5. Detection rule: threshold or query match — document on lab paper.
On $HUNT_LAB, map three jsonl keys to ECS field names for hunt hypothesis.
Command guide
Try these commands — ELK hunt concepts (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Elastic KQL — https://www.elastic.co/guide/en/security/current/kuery-query-language.html Elastic detection — https://www.elastic.co/guide/en/security/current/detection-engine-overview.html Sigma Elastic — https://github.com/SigmaHQ/sigma
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
curl -sS https://www.elastic.co/guide/en/security/current/kuery-query-language.html | head -10
cat > "$HUNT_LAB/hunt/elk-literacy-cheatsheet.txt" <<'EOF'
Elastic/KQL literacy (YOUR lab jq bridge):
process.parent.name: winword.exe AND process.name: powershell.exe
event.code: 4625 AND source.ip: 203.0.113.77
destination.ip: 203.0.113.99 AND network.direction: outbound
Lab jq: jq 'select(.parent=="winword.exe")' logs/process.jsonl
No live Elastic cluster required — file-based hunt literacy
EOFCommand — copy this
grep -E 'KQL|jq|No live' "$HUNT_LAB/hunt/elk-literacy-cheatsheet.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: Elastic KQL (https://www.elastic.co/guide/en/security/current/kuery-query-language.html); Elastic detection (https://www.elastic.co/guide/en/security/current/detection-engine-overview.html); Sigma Elastic (https://github.com/SigmaHQ/sigma). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why ECS helps cross-source hunts
Normalized fields let L2 correlate auth, proxy, and process logs with same source.ip semantics — when ingest follows ECS. Students compare lab jsonl to ECS cheat sheet — not production mapping without ticket.
Defenders tune ingest pipelines — hunt literacy includes 'field exists?' questions on escalation.
3. Literacy ≠ Elastic Cloud abuse
Forbidden: leaked Elastic API key on employer cluster. Allowed: ELK literacy card — index, three ECS fields, one KQL line, $HUNT_LAB file mapping.
Ship: ELK literacy card for YOUR lab files. Next: KQL/jq Bridge.
4. What you ship: ELK literacy card for $HUNT_LAB
Index, ECS fields, conceptual KQL, lab file mapping. $HUNT_LAB named. NO stranger cluster. chmod 600.
5. What you record before the next lesson
Date. ELK card. $HUNT_LAB named. File t30-m04-l02-elk-literacy.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Query Elastic Cloud with leaked key. Ignore ECS when correlating lab sources.
Right
Write ELK literacy card for YOUR $HUNT_LAB files. Next: KQL/jq Bridge.
Mission: map ELK concepts to YOUR lab jsonl
1) Name index vs data stream in one sentence each. 2) Map three jsonl keys to ECS. 3) Write one conceptual KQL filter. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
ECS source.ip beats guessing whether field is src_ip or SourceNetworkAddress.
Knowledge Check
APPLY: Elastic Discover primarily uses:
Multiple choice
Knowledge Check
APPLY: True or False: ECS normalizes field names across log sources for correlation.
True or False
Knowledge Check
APPLY: ELK literacy on Cyberlium avoids:
Multiple choice