SOC › Module 1 › Lesson 4
Lab — Setup
Pack hunt scope, telemetry inventory, and ethics card — lab setup file only, dest $HUNT_LAB.
Visual · t30_lab_setup
Lab: write hunt setup pack. $HUNT_LAB only. Original Cyberlium.
Opening
Lab setup before hunt queries — scope paperwork L2 mentors expect.
Lessons 1–3 defined why SOC L2 matters, lab telemetry only, and offensive-playbook refusal. This lab ships the combined artifact: topic scope paragraph, telemetry inventory row, and ethics card for $HUNT_LAB under $HOME/cyberlium-lab/t30-hunt/. No live tenant access required — scope and telemetry paperwork first. Next: Quiz — L2 Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t30-m01-l04-lab-setup.txt with date, operator, $HUNT_LAB telemetry placeholder, literacy vs unauthorized hunt paragraph, telemetry inventory row, and ethics card.
Optional: one-line proof your t30-hunt sample folder exists — still no production SIEM work required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
RoE literacy — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Sigma — https://sigmahq.io/ Elastic guide — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/roe.txt" <<'EOF'
HUNT_LAB=$HOME/cyberlium-lab/t30-hunt
targets: YOUR seeded process.jsonl, netflow.jsonl, auth.jsonl, alerts.json — FAKE events only
never: Impacket/Mimikatz/Cobalt recipes, malware payloads, stranger machine isolation
allowed: mkdir logs, jq/python3 hunt queries, grep logs, curl MITRE/sigma/elastic/splunk docs
output: hunt-hypothesis.md, correlation notes, PICERL checklist, PIR template in lab folder
EOFCommand — copy this
chmod 600 "$HUNT_LAB/roe.txt" grep -E 'HUNT_LAB|never|allowed|targets' "$HUNT_LAB/roe.txt" command -v jq >/dev/null && jq --version || echo 'jq not installed — install for JSONL hunt queries'
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t30-hunt/roe.txt | Select-String never
jq --version 2>$null; if (-not $?) { Write-Output 'Install jq for JSONL hunt queries' }Primary tools to practice this lesson: grep, curl. Reference sites: RoE literacy (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Sigma (https://sigmahq.io/); Elastic guide (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'Splunk token,' production tenant hostnames, live hunt IDs, exploit scripts, or victim telemetry dumps — redact or delete. Rewrite forum habits to $HUNT_LAB placeholders before you copy workflows.
Classmates build their own setup packs for their $HUNT_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Hunt Methodology.
L2 mentors archive lab setup before first sample telemetry search; you are practicing that habit early.
4. What you ship: hunt lab setup pack for $HUNT_LAB
Setup pack: scope, telemetry row, ethics card. $HUNT_LAB named. NEVER stranger SIEM. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $HUNT_LAB scope note. File t30-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and query unknown Splunk tenant. Add production cluster to approved list.
Right
Write YOUR lab setup pack for $HUNT_LAB. chmod 600. Next: Quiz — L2 Mindset and Lab.
Mission: freeze YOUR lab setup pack on disk
1) Merge scope, telemetry, ethics sections. 2) Name $HUNT_LAB. 3) chmod 600. Never list production SIEM hunting as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps hunt work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on hunt lab notes.
True or False
Knowledge Check
APPLY: A tutorial queries live Splunk without scope. You:
Multiple choice