SOC › Module 4 › Lesson 3
KQL jq Bridge
KQL/jq bridge literacy translates the same hunt question across syntaxes on YOUR $HUNT_LAB jsonl — one hypothesis, three query forms.
Visual · t30_kql_jq_bridge
KQL/jq bridge literacy. $HUNT_LAB only. Original Cyberlium.
Opening
Same hunt, different syntax — literacy bridges KQL, SPL, and jq on lab telemetry before vendor lock-in bites you.
L2 analysts switch SIEMs — bridging syntax preserves hunt intent. Same failed-auth hunt: KQL event.outcome:failure | summarize count() by source.ip; SPL index=auth action=failure | stats count by src_ip; jq.[] | select(.outcome=="failure") | group_by(.src_ip) on $HUNT_LAB/auth.jsonl. Cyberlium writes bridge table on YOUR $HUNT_LAB — run jq locally; SPL/KQL on paper. Next: SIEM Lab.
1. Bridge patterns (named)
Time bound: KQL @timestamp, SPL earliest=, jq select by.timestamp range. Filter: field equality vs select(). Aggregate: summarize/stats/group_by. Output: same hunt question, three columns in bridge table.
On $HUNT_LAB, complete bridge table row: hunt question, KQL, SPL, jq for one technique hypothesis.
Command guide
Try these commands — Bridge patterns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
jq manual — https://jqlang.github.io/jq/manual/
Elastic KQL — https://www.elastic.co/guide/en/security/current/kuery-query-language.html Splunk SPL — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/kql-jq-bridge.md" <<'EOF'
# KQL/SPL → jq Bridge (YOUR lab)
| SIEM query | jq equivalent |
|---|---|
| ParentProcessName=winword.exe | jq 'select(.parent=="winword.exe")' process.jsonl |
| EventCode=4625 | jq 'select(.event_id==4625)' auth.jsonl |
| dest_ip=203.0.113.99 | jq 'select(.dst_ip=="203.0.113.99")' netflow.jsonl |
EOFCommand — copy this
jq -c 'select(.event_id==4625) | {user, src_ip, ts}' "$HUNT_LAB/logs/auth.jsonl"
jq -c 'select(.parent=="winword.exe") | {process, cmdline}' "$HUNT_LAB/logs/process.jsonl"
grep winword "$HUNT_LAB/hunt/kql-jq-bridge.md"Primary tools to practice this lesson: jq, python3. Reference sites: jq manual (https://jqlang.github.io/jq/manual/); Elastic KQL (https://www.elastic.co/guide/en/security/current/kuery-query-language.html); Splunk SPL (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why bridging beats single-vendor memorization
Organizations migrate SIEMs — hunt intent survives syntax changes. Interviews ask conceptual 'find failed logins last hour' — bridge literacy answers from lab samples.
Defenders document runbooks in org-standard syntax — students practice translation on $HUNT_LAB.
3. Ethics: lab jsonl only
Forbidden: running bridge queries on stranger production tenants. Allowed: bridge table — one hunt row with $HUNT_LAB jsonl path and chmod 600 notes.
Ship: KQL/jq bridge table for YOUR hunt hypothesis. Next: SIEM Lab.
4. What you ship: KQL/jq bridge table for $HUNT_LAB
One hunt row: question, KQL, SPL, jq. $HUNT_LAB named. NO prod queries. chmod 600.
5. What you record before the next lesson
Date. Bridge table. $HUNT_LAB named. File t30-m04-l03-kql-jq-bridge.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Memorize KQL only and ignore jq offline practice. Query stranger Sentinel without scope.
Right
Write KQL/jq bridge table for YOUR $HUNT_LAB hunt. Next: SIEM Lab.
Mission: bridge three syntaxes for YOUR hunt
1) Pick one M3 hunt hypothesis. 2) Write KQL, SPL, jq equivalents. 3) Run jq on jsonl and note UTC. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Same question, three syntaxes — that is portable L2 SIEM literacy.
Knowledge Check
APPLY: KQL/jq bridge on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: jq on local jsonl teaches aggregation intent transferable to KQL/SPL.
True or False
Knowledge Check
APPLY: Bridge literacy avoids:
Multiple choice