Lion Cipher Lab
Centralize your logs (the idea behind every SIEM)
- SOC Analyst / Blue Team
- Beginner
- ~45 min
- Free · no account required
Why it matters
Every earlier logging lab looked at logs on the machine that produced them. That doesn't scale and it isn't safe: with dozens of machines you can't log into each one to investigate, related events on different hosts are impossible to correlate, and — critically — an attacker who compromises a machine can delete its local logs to cover their tracks. Centralizing logs solves all three: ship every machine's logs to one collector, and you get a single place to search, the ability to correlate activity across hosts, and a copy of the evidence that survives even if the original machine is wiped.…
What you'll learn
- why logs must be centralized
- forwarding logs with rsyslog
- the collect-normalize-search pipeline
- why a central log store aids detection and survives tampering
- how this scales into a SIEM
Steps in this lab
- Why local logs aren't enough
- The pipeline: collect, normalize, search
- Set up a collector with rsyslog
- Forward logs from another machine
- Why the central copy matters for security
- How this grows into a SIEM
- Why one place to look changes everything