SOC › Module 4 › Lesson 1
SPL Literacy
SPL literacy names Splunk search patterns — time bounds, field filters, stats, transaction — mapped on YOUR $HUNT_LAB hunt intent before live cluster login.
Visual · t30_spl_literacy
SPL literacy. $HUNT_LAB only. Original Cyberlium.
Opening
SPL pipes transform results — literacy reads hunt intent on lab notes before you paste searches into stranger Splunk.
Advanced SPL patterns for L2 hunts: time modifiers (earliest, latest), field filters, stats/timechart/chart aggregations, transaction for session grouping, join/subsearch for correlation (conceptual). Example literacy: index=winauth EventCode=4625 earliest=-1h | stats count by src_ip | where count>10 — mapped to YOUR auth jsonl intent. Cyberlium names SPL on YOUR $HUNT_LAB — write on paper or map to jq; never query stranger indexes. Next: ELK Literacy.
1. SPL hunt patterns (named, conceptual)
Time: earliest=-24h@h latest=now. Filter: index=auth action=failure. Aggregate: stats count, dc(user), rare values. Session: transaction start/end on lab fictional session ID. Correlation: subsearch pattern — literacy only on paper.
On $HUNT_LAB, write three SPL lines (conceptual) for one hunt hypothesis — time bound required.
Command guide
Try these commands — SPL hunt patterns (named, conceptual)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Splunk SPL — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual Splunk stats — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats MITRE — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/spl-literacy-cheatsheet.txt" <<'EOF'
SPL literacy (map to YOUR jq queries on FAKE JSONL):
index=auth EventCode=4625 | stats count by src_ip,user
index=process ParentProcessName=winword.exe ChildProcessName=powershell.exe
index=netflow dest_ip=203.0.113.99 | timechart span=1m sum(bytes_out)
... | transaction user maxspan=5m (failed then success sequence)
Lab: jq/python3 equivalents on YOUR logs — no live Splunk required
EOFCommand — copy this
grep -E 'index=|Lab:|jq' "$HUNT_LAB/hunt/spl-literacy-cheatsheet.txt" curl -sS https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Splunk SPL (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/WhatsInThisManual); Splunk stats (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why SPL literacy helps L2 escalations
L2 reads L1 and hunt saved searches — understanding stats vs transaction prevents misread results. Performance: unbounded SPL melts clusters — time and index scope first.
Students map SPL intent to lab jsonl jq equivalent — transferable skill without stranger tenant.
3. Literacy ≠ stranger Splunk abuse
Forbidden: leaked Splunk token hunts on production finance index. Allowed: SPL literacy card — five patterns with $HUNT_LAB hunt question mapping.
Ship: SPL literacy card for YOUR lab hunt intent. Next: ELK Literacy.
4. What you ship: SPL literacy card for $HUNT_LAB
Five conceptual SPL patterns mapped to hunt question. $HUNT_LAB named. NO stranger cluster. chmod 600.
5. What you record before the next lesson
Date. SPL card. $HUNT_LAB named. File t30-m04-l01-spl-literacy.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run unbounded SPL on stranger index. Skip time modifier in every example.
Right
Write SPL literacy card for YOUR $HUNT_LAB hunt intent. Next: ELK Literacy.
Mission: write SPL patterns for YOUR lab hunt
1) Write time-bounded filter line. 2) Write stats aggregation line. 3) Map both to jq intent on jsonl. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
index= and earliest= first — unbounded SPL is how hunts become incidents.
Knowledge Check
APPLY: SPL on Cyberlium is practiced as:
Multiple choice
Knowledge Check
APPLY: True or False: stats and timechart aggregate hunt results in SPL.
True or False
Knowledge Check
APPLY: SPL literacy avoids:
Multiple choice