SOC › Module 5 › Lesson 4
Lab — Correlation
Pack correlation, dashboard, and L2 tuning cards — correlation file from $HUNT_LAB only.
Visual · t30_correlation_lab
Lab: correlation pack. $HUNT_LAB only. Original Cyberlium.
Opening
Correlation pack merges sketch to dashboard to tuning — paperwork before IR lifecycle module.
Lessons 5-1–5-3 named correlation patterns, dashboard wireframes, and L2 tuning feedback. This lab merges three sections into one $HUNT_LAB correlation artifact with optional jq KPI counts. No production dashboard or rule deployment — correlation literacy paperwork only. Next: Quiz — Correlation and Dashboards.
1. Lab contract: correlation pack
Create $HOME/cyberlium-lab/t30-m05-l04-correlation-lab.txt merging correlation sketch, dashboard wireframe, and L2 tuning plan with $HUNT_LAB scenario ID and M1 ethics cross-reference.
Optional: paste jq count output for one dashboard KPI — redacted fictional values only.
Command guide
Try these commands — Lab contract: correlation pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Correlation — https://attack.mitre.org/ Elastic cases — https://www.elastic.co/guide/en/security/current/cases-ui.html NIST — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
echo '=== Correlation lab: full LAB-IR-001 chain ==='
jq '[.[] | select(.scenario=="LAB-IR-001")]' "$HUNT_LAB/logs/alerts.json"
python3 - <<'PY'
import json, os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
alerts = json.load(open(os.path.join(lab,'logs','alerts.json')))
chain = [a for a in alerts if a.get('scenario')=='LAB-IR-001']
print(f'LAB-IR-001 correlated alerts: {len(chain)}')
for a in chain: print(f" {a['id']}: {a['title']} ({a['mitre']})")
PYCommand — copy this
grep -E 'Chain|HNT-|LAB-IR' "$HUNT_LAB/hunt/correlation-notes.md" grep '\[ \]' "$HUNT_LAB/dashboards/dashboard-checklist.md" | head -3
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t30-hunt/hunt/correlation-notes.md | Select-String LAB-IR Get-Content $HOME/cyberlium-lab/t30-hunt/dashboards/dashboard-checklist.md | Select-String panel
Primary tools to practice this lesson: jq, grep. Reference sites: Correlation (https://attack.mitre.org/); Elastic cases (https://www.elastic.co/guide/en/security/current/cases-ui.html); NIST (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for production index names, live dashboard URLs, stranger tenant refs — remove. Pack labels all artifacts as $HUNT_LAB training only.
Confirm offensive playbook refs stay detection literacy — no how-to steps.
3. Lock the proof
chmod 600 on the pack. Quiz next — then PICERL Named in M6.
Correlation literacy feeds IR lifecycle lessons next module.
4. What you ship: correlation pack for $HUNT_LAB
Merged correlation, dashboard, tuning sections. $HUNT_LAB named. NO prod deploy. chmod 600.
5. What you record before the next lesson
Date. Correlation pack path. $HUNT_LAB named. File t30-m05-l04-correlation-lab.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include production Kibana URL in pack. Skip L2 tuning section.
Right
Write YOUR correlation pack for $HUNT_LAB. chmod 600. Next: Quiz — Correlation and Dashboards.
Mission: freeze YOUR correlation pack
1) Merge M5 literacy sections. 2) Confirm zero production refs. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed correlation pack beats ten noisy dashboards on a stranger tenant.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Correlation pack must label scenarios as $HUNT_LAB training only.
True or False
Knowledge Check
APPLY: Hunt findings in correlation pack feed:
Multiple choice