SOC › Module 5 › Lesson 2
Dashboards Named
Dashboard literacy names KPI panels, hunt progress boards, and detection health views — design on YOUR $HUNT_LAB metrics on paper without stranger Kibana login.
Visual · t30_dashboards_named
Dashboard literacy. $HUNT_LAB only. Original Cyberlium.
Opening
Dashboards tell leadership and L2 what matters — literacy names panel types before you build on production tenants.
SOC dashboards show: alert volume trends, MTTR, hunt campaign status, detection coverage by ATT&CK tactic, top noisy rules, ingest health. L2 contributes hunt findings panels and correlation summaries — design as paper wireframe mapped to $HUNT_LAB fictional metrics. Cyberlium names dashboard panels on YOUR $HUNT_LAB — counts from jq on jsonl for fake KPIs; never screenshot stranger employer dashboards with customer names. Next: Tuning L2.
1. Dashboard panel types (named)
Trend: alert volume over time on lab fictional queue. Table: top 10 src_ip failed auth from jq count. Coverage: ATT&CK tactics with/without rules — literacy map. Health: jsonl ingest lag fictional metric.
On $HUNT_LAB, wireframe four panels for one L2 hunt dashboard on paper.
Command guide
Try these commands — Dashboard panel types (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: Splunk dashboards (https://docs.splunk.com/Documentation/Splunk/latest/Viz/DashboardExamples); Elastic dashboards (https://www.elastic.co/guide/en/kibana/current/dashboard.html); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why dashboards support L2 hunts
Dashboards communicate hunt progress to L3 and detection engineering — repeatable KPIs beat ad-hoc screenshots. Good panels cite data source and refresh interval — even on lab wireframes.
Defenders restrict dashboard RBAC — students design on paper before vendor UI.
3. Literacy ≠ stranger dashboard export
Forbidden: sharing live employer Kibana dashboard with customer hostnames. Allowed: dashboard wireframe — four panels, data source, $HUNT_LAB jq metric example.
Ship: dashboard wireframe for YOUR lab hunt KPIs. Next: Tuning L2.
4. What you ship: dashboard wireframe for $HUNT_LAB
Four panels with data source and lab metric. $HUNT_LAB named. NO stranger dashboard export. chmod 600.
5. What you record before the next lesson
Date. Dashboard wireframe. $HUNT_LAB named. File t30-m05-l02-dashboards-named.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Screenshot production dashboard with PII. Wireframe panels with no data source labeled.
Right
Write dashboard wireframe for YOUR $HUNT_LAB hunt KPIs. Next: Tuning L2.
Mission: wireframe hunt dashboard on YOUR lab metrics
1) Name four panel types. 2) Cite $HUNT_LAB jsonl source per panel. 3) One jq-derived fake KPI example. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Label refresh interval even on wireframes — stale panels mislead leadership.
Knowledge Check
APPLY: L2 hunt dashboards may show:
Multiple choice
Knowledge Check
APPLY: True or False: Dashboard wireframes can use jq counts from lab jsonl as fake KPIs.
True or False
Knowledge Check
APPLY: Dashboard literacy on Cyberlium avoids:
Multiple choice