SOC › Module 5 › Lesson 1
Correlation Named
Correlation literacy names multi-source timelines — auth plus proxy plus process on YOUR $HUNT_LAB — join keys and sequence without live stranger data.
Visual · t30_correlation_named
Correlation literacy. $HUNT_LAB only. Original Cyberlium.
Opening
One log line is noise — correlation builds the story on lab timelines before you pivot stranger production indexes.
L2 correlation joins sources by time, host, user, or IP: auth failure burst + proxy deny + rare process on same lab host within 30 minutes raises hunt priority. Techniques: temporal proximity, shared entity keys, rare co-occurrence, sequence rules (conceptual EQL/SPL transaction) — literacy on $HUNT_LAB fictional assets. Cyberlium sketches correlation on YOUR $HUNT_LAB multi-file timeline — never import employer exports without ticket. Next: Dashboards Named.
1. Correlation patterns (named)
Entity join: same source.ip across auth jsonl and proxy jsonl. Time window: events within 15–60m on lab UTC timeline. Sequence: A then B then C on fictional LAB-WS-01. Rarity: first-seen user-agent plus auth failure cluster.
On $HUNT_LAB, sketch 3-event correlation on one fictional host with join key named.
Command guide
Try these commands — Correlation patterns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Correlation rules — https://www.elastic.co/guide/en/security/current/rules-ui.html MITRE correlation — https://attack.mitre.org/ (multi-stage attack chains) NIST IR — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/correlation-notes.md" <<'EOF'
# Correlation Notes — LAB-IR-001 (YOUR seeded telemetry)
## Chain observed (FAKE data)
1. T1110.001 — 3x 4625 then 4624 success (jsmith, 203.0.113.77)
2. T1059.001 — winword.exe → powershell.exe (WIN-HUNT01, +11min)
3. T1071.001 — periodic HTTPS to 203.0.113.99:443 (beacon pattern)
## Correlation keys
- user: jsmith | host: WIN-HUNT01 | time window: 04:10–04:14 UTC
## Alerts correlated
- HNT-001 + HNT-002 + HNT-003 → single campaign hypothesis
## Lab scope only — document, do not isolate stranger machines
EOFCommand — copy this
echo '=== jq multi-source correlation ===' jq -c 'select(.user=="jsmith")' "$HUNT_LAB/logs/auth.jsonl" jq -c 'select(.host=="WIN-HUNT01" and .process=="powershell.exe")' "$HUNT_LAB/logs/process.jsonl" jq -c 'select(.host=="WIN-HUNT01")' "$HUNT_LAB/logs/netflow.jsonl" grep LAB-IR "$HUNT_LAB/hunt/correlation-notes.md"
Primary tools to practice this lesson: jq, python3. Reference sites: Correlation rules (https://www.elastic.co/guide/en/security/current/rules-ui.html); MITRE correlation (https://attack.mitre.org/); NIST IR (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why correlation is core L2 skill
Alerts fire on single rules — L2 proves or disproves compromise narrative across sources. Poor correlation wastes L3 time; good correlation speeds IR handoff with evidence chain.
Students align timestamps to UTC on lab notes — correlation breaks on silent timezone skew.
3. Literacy ≠ live multi-tenant pivot
Forbidden: correlating stranger production auth with scraped breach proxy logs. Allowed: correlation sketch — three sources, join key, timeline on $HUNT_LAB.
Ship: correlation sketch for YOUR lab multi-source scenario. Next: Dashboards Named.
4. What you ship: correlation sketch for $HUNT_LAB
Three sources, join key, UTC timeline on fictional host. $HUNT_LAB named. chmod 600.
5. What you record before the next lesson
Date. Correlation sketch. $HUNT_LAB named. File t30-m05-l01-correlation-named.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Correlate production PII exports without scope. Ignore timestamps in sketch.
Right
Write correlation sketch for YOUR $HUNT_LAB multi-source scenario. Next: Dashboards Named.
Mission: sketch correlation on YOUR lab timeline
1) Name three jsonl/log sources from $HUNT_LAB. 2) Pick join key (IP, host, user). 3) Sketch 3-event UTC timeline. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Join key must exist in all three lab files — or correlation is fiction.
Knowledge Check
APPLY: Correlation on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: UTC-aligned timestamps improve cross-source correlation.
True or False
Knowledge Check
APPLY: Correlation literacy avoids:
Multiple choice