SOC › Module 4 › Lesson 4

BeginnerModule 4Lesson 4/5

Lab — SIEM

Pack SPL, ELK, and KQL/jq bridge cards — advanced SIEM file from $HUNT_LAB only.

25 min+40 XP3 quiz

Module progress4 of 5

Visual · t30_siem_lab

Lab: advanced SIEM pack. $HUNT_LAB only. Original Cyberlium.

Opening

Advanced SIEM pack merges SPL to ELK to bridge — paperwork before correlation module.

Lessons 4-1–4-3 named SPL patterns, ELK/ECS vocabulary, and KQL/jq bridge tables. This lab merges three sections with optional jq output from YOUR $HUNT_LAB jsonl. No stranger cluster access — advanced SIEM literacy paperwork only. Next: Quiz — Advanced SIEM Literacy.

1. Lab contract: advanced SIEM pack

Create $HOME/cyberlium-lab/t30-m04-l04-siem-lab.txt merging SPL, ELK, and bridge sections with $HUNT_LAB jsonl paths and M1 ethics cross-reference.

Optional: paste redacted jq output from failed-auth count — no production usernames.

Command guide

Try these commands — Lab contract: advanced SIEM pack

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Splunk ES — https://docs.splunk.com/Documentation/ES Elastic Security — https://www.elastic.co/guide/en/security/current/index.html Sigma — https://sigmahq.io/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows:

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/logs/alerts.json" <<'EOF'
[
  {"id":"HNT-001","severity":"high","title":"Rare parent: winword→powershell","host":"WIN-HUNT01","user":"jsmith","mitre":"T1059.001","status":"new","scenario":"LAB-IR-001"},
  {"id":"HNT-002","severity":"critical","title":"Failed-then-success logon","host":"WIN-HUNT01","user":"jsmith","src_ip":"203.0.113.77","mitre":"T1110.001","status":"new","scenario":"LAB-IR-001"},
  {"id":"HNT-003","severity":"high","title":"Beacon-like HTTPS to 203.0.113.99","host":"WIN-HUNT01","dst_ip":"203.0.113.99","mitre":"T1071.001","status":"new","scenario":"LAB-IR-001"},
  {"id":"HNT-004","severity":"medium","title":"SMB lateral from svc_backup","host":"WIN-HUNT02","src_ip":"10.0.3.50","mitre":"T1021.002","status":"new","scenario":"LAB-IR-002"}
]
EOF

Command — copy this

echo '=== SIEM lab: enrich HNT-002 with auth.jsonl ==='
jq '.[] | select(.id=="HNT-002")' "$HUNT_LAB/logs/alerts.json"
jq -c 'select(.user=="jsmith")' "$HUNT_LAB/logs/auth.jsonl"
grep -E 'SPL|KQL|jq' "$HUNT_LAB/hunt/spl-literacy-cheatsheet.txt" "$HUNT_LAB/hunt/elk-literacy-cheatsheet.txt"

═══ WINDOWS ═══

Command — copy this

Get-Content $HOME/cyberlium-lab/t30-hunt/hunt/kql-jq-bridge.md | Select-String jq
Get-Content $HOME/cyberlium-lab/t30-hunt/logs/alerts.json | Select-String HNT-002

Primary tools to practice this lesson: jq, grep. Reference sites: Splunk ES (https://docs.splunk.com/Documentation/ES); Elastic Security (https://www.elastic.co/guide/en/security/current/index.html); Sigma (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Cross-check ethics

Grep for Splunk token, Elastic API key, production index names — remove. Pack labels all queries as $HUNT_LAB conceptual only.

Confirm every query example includes time-bound language.

3. Lock the proof

chmod 600 on the pack. Quiz next — then Correlation Named.

Advanced SIEM literacy feeds correlation lessons in M5.

4. What you ship: advanced SIEM pack for $HUNT_LAB

Merged SPL, ELK, bridge sections. $HUNT_LAB named. NO stranger cluster. chmod 600.

5. What you record before the next lesson

Date. SIEM pack path. $HUNT_LAB named. File t30-m04-l04-siem-lab.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Include production Splunk index in pack. Skip bridge table section.
Right
Write YOUR advanced SIEM pack for $HUNT_LAB. chmod 600. Next: Quiz — Advanced SIEM Literacy.

Mission: freeze YOUR advanced SIEM pack

1) Merge M4 literacy sections. 2) Confirm zero production tenant refs. 3) Link M1 ethics cross-ref. 4) chmod 600.

Stuck? Ask Cyberlium AI Mentor

Delete any accidental API key from pack before quiz.

Knowledge Check

APPLY: This lab requires:

Multiple choice

Knowledge Check

APPLY: True or False: SIEM pack must include time-bound query examples.

True or False

Knowledge Check

APPLY: jq in SIEM pack is:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP