SOC › Module 10 › Lesson 2
Lab Path
SOC Level 1 literacy path on $SOC_LAB — sample logs to mentor handoff with ethics gates at every station.
Visual · t29_lab_path
Lab path = visual SOC chain on YOUR $SOC_LAB. Original Cyberlium.
Opening
Draw the path from lab scope to mentor handoff — with stop signs at every unauthorized SIEM and attack shortcut.
Document literacy path: $SOC_LAB setup → SIEM query literacy → log sources → detection rules → triage → common detections (phishing/malware/brute triage only) → ticketing/escalation → report/handoff → capstone. Ethics gates: unauthorized prod SIEM, phishing send, malware authoring, brute-force run, prod ticket/escalation, prod case paste — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live SIEM — labeled. Defender breakpoint: where RoE or triage discipline prevented out-of-scope test.
1. Path stations
Setup, SIEM, sources, rules, triage, detections, ticketing, report, handoff — nine minimum stations.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: jq, curl. Reference sites: Elastic Security (https://www.elastic.co/guide/en/security/current/index.html); Splunk ES (https://docs.splunk.com/Documentation/ES); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops: unauthorized SIEM, offensive detection cookbooks, prod tickets/escalation, prod case paste.
RoE branch always green start — sample alerts on separate labeled branch.
3. Integrity breakpoint
Mark where scope check or triage discipline prevented out-of-RoE test.
One paragraph uplift from YOUR $SOC_LAB path.
4. What you ship: lab path diagram
SOC chain with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes phishing campaign shortcut lane.
Right
Lab path documented for $SOC_LAB. Next: Evidence Pack.
Mission: lab path diagram
1) Map nine stations. 2) Add six ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive attack shortcut OK on path.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice