Lion Cipher Lab
Draft an incident timeline from raw logs with a local LLM — then verify every single event
- AI Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
When an incident breaks, the first painful job is turning a pile of raw logs into a story: what happened, in what order, and how do we know. A local LLM can draft that narrative in seconds — a genuine accelerator over noisy, multi-source logs. But an LLM's confident prose is exactly what makes it dangerous: it will invent an event that never happened, slide a timestamp, or quietly drop a real line, and say it all with a straight face. This lab teaches the one habit that makes LLM-assisted DFIR safe: treat the timeline as a DRAFT, verify every event back to a real log line, measure how much…
What you'll learn
- using a local LLM to draft a first-pass incident narrative from raw logs
- cross-source correlation (auth log + web log) into one chronological story
- reading real log formats: syslog SSH lines and combined web-access lines
- verifying an LLM's output line-by-line against source evidence
- catching a hallucinated event that has no source log line
- catching a mis-ordering / timezone slip in a timeline
- spotting an omission — a real event the model dropped
- computing precision (events verified / events claimed) to score a draft
- judging when an LLM accelerates DFIR and when it must never be trusted
Steps in this lab
- The words you need, and where this fits
- When an LLM belongs in DFIR — and when it absolutely does not
- Get Ollama and a small model ready (free, local)
- Create the synthetic evidence: a small multi-source log bundle
- Ask the local model to draft a cited timeline
- Why this is a draft, not the record
- Verify every event: catch the hallucination, the mis-order, the omission, and score it
- The evidentiary record needs deterministic tooling, not an LLM