Lion Cipher Lab
Hunt for IOCs in your logs with grep, awk, and jq
- Threat Intel Analyst
- Beginner
- ~50 min
- Free · no account required
Why it matters
When a security team gets a warning — a government advisory, a threat report, a vendor email — it almost always arrives as a list of indicators of compromise: 'if you see these IPs, domains, or file hashes, you may be affected.' The very first thing a defender does is turn that list on their OWN logs and ask a blunt question: is any of this in my environment, and how much? That search is the heartbeat of a Security Operations Center, and the surprise for most newcomers is that the core tools are free, already installed, and decades old: grep, awk, and jq. You do not need an expensive platform…
What you'll learn
- reading a log line and naming its fields (who, when, what, result)
- searching a log for a single IOC and getting a hit count with grep -c
- hunting a whole IOC list against your logs at once with grep -F -f
- pulling out columns and counting top talkers with awk, sort, and uniq
- searching JSON logs by field with jq (select by src_ip, domain, or hash)
- spotting false positives — substring and benign matches that are not real hits
- writing a short, honest findings summary: what you searched, what hit, and how many
Steps in this lab
- The words first: log, IOC, threat hunting, terminal
- The three tools: grep, awk, jq — and the one that ties them together, the pipe
- Open a terminal and confirm your tools (macOS, Linux, or Windows)
- Generate your sample data (you are never blocked on logs)
- Meet your IOC list: what each indicator is
- Your first hunt: grep one IOC and count the hits
- Hunt the WHOLE list at once with grep -f
- Add context with awk: columns, top talkers, and matched fields
- Search JSON logs with jq (by field name, not by guessing)
- Watch for false positives: not every match is a real hit
- Write the findings summary: the artifact that matters
- Why this reflex is worth building