SOC › Module 1 › Lesson 2
Lab Telemetry Only
Lab telemetry only means YOUR synthetic auth jsonl, process, and proxy samples under $HUNT_LAB — document sample IDs in notes before any hunt-style query run.
Visual · t30_lab_telemetry_only
Lab telemetry literacy. $HUNT_LAB only. Original Cyberlium.
Opening
The jsonl file is part of scope — Cyberlium refuses hunt work on datasets and tenants you do not own or lack written permission to analyze.
Lab telemetry is jsonl or text YOU generated, a courseware hunt pack labeled for training, or a Cyberlium synthetic auth/process sample shipped for Topic 30. Intentional suspicious patterns live in $HUNT_LAB only — never copied from production exports without authorization. Cyberlium maps allowed samples on YOUR $HUNT_LAB inventory — file name, source, owner — never 'borrowed' employer Splunk exports or scraped victim dumps. Next: No Offensive Playbooks.
1. Allowed lab surfaces (named)
Self-authored auth jsonl with fake usernames and IPs. Course process telemetry snippets with labeled TTP context. Proxy jsonl with synthetic URLs. Cyberlium t30-hunt packs with explicit training labels.
On $HUNT_LAB, list telemetry type, source file, and owner — fictional hostnames OK if labeled sample.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Elastic Security — https://www.elastic.co/guide/en/security/current/index.html (advanced SIEM literacy) Splunk docs — https://docs.splunk.com/Documentation/Splunk/latest (SPL hunt context) Sigma — https://sigmahq.io/ (portable detection for hunt validation)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t30-hunt/logs" "$HOME/cyberlium-lab/t30-hunt/hunt" "$HOME/cyberlium-lab/t30-hunt/ir" "$HOME/cyberlium-lab/t30-hunt/dashboards" "$HOME/cyberlium-lab/t30-hunt/pir" cat > "$HOME/cyberlium-lab/t30-hunt/lab.env" <<'EOF' export HUNT_LAB=$HOME/cyberlium-lab/t30-hunt export HUNT_LAB_LOGS=$HOME/cyberlium-lab/t30-hunt/logs export HUNT_LAB_HUNT=$HOME/cyberlium-lab/t30-hunt/hunt export HUNT_LAB_IR=$HOME/cyberlium-lab/t30-hunt/ir EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t30-hunt/lab.env" grep -E 'HUNT_LAB' "$HOME/cyberlium-lab/t30-hunt/lab.env" curl -sS https://docs.splunk.com/Documentation/Splunk/latest | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: Elastic Security (https://www.elastic.co/guide/en/security/current/index.html); Splunk docs (https://docs.splunk.com/Documentation/Splunk/latest); Sigma (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why telemetry scope matters before hunts
Splunk, Elastic, and jq are powerful on any dataset — scope is what keeps practice legal and ethical. Production SIEM exports, stranger cloud tenants, and scraped breach dumps are out of scope.
If you cannot answer 'who owns this telemetry and who approved analysis?', pause and fix scope notes before running hunt searches.
3. Telemetry inventory habit
Forbidden: using a trending breach jsonl dump because it 'looks like training.' Allowed: telemetry card — type, source, owner, allowed operations (search YOUR auth jsonl, count failed logins only).
Ship: telemetry inventory row for one $HUNT_LAB sample. Next: No Offensive Playbooks.
4. What you ship: lab telemetry inventory row for $HUNT_LAB
Telemetry type, source, owner, allowed ops. $HUNT_LAB named. NEVER production exports. chmod 600.
5. What you record before the next lesson
Date. Telemetry inventory row. $HUNT_LAB named. File t30-m01-l02-lab-telemetry-only.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import employer Splunk export because lab telemetry is boring. Skip telemetry card because 'it's just jq.'
Right
Write telemetry inventory row for YOUR $HUNT_LAB sample. Next: No Offensive Playbooks.
Mission: document YOUR hunt lab telemetry sample
1) Name one self-authored or course telemetry sample. 2) Record source and owner. 3) List two allowed operations on that sample. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Self-authored synthetic telemetry beats irreversible mistakes on production PII exports.
Knowledge Check
APPLY: Lab telemetry only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Searching failed-login patterns on jsonl YOU authored is acceptable lab practice.
True or False
Knowledge Check
APPLY: Before running a hunt-style query you should:
Multiple choice