Lion Cipher Lab
Analyze logs with the Elastic Stack
- SOC Analyst / Blue Team
- Beginner
- ~60 min
- Free · no account required
Why it matters
Centralizing logs gets them into one place; analysis is what turns that pile into answers. The Elastic Stack — Elasticsearch to index and search, Kibana to explore and visualize — is the open-source engine a huge share of the industry uses to do exactly that, and it is the searchable-store-and-dashboards core that platforms like Wazuh and full SIEMs are built on top of. Learning to ingest logs, search them with a real query language, and build a dashboard on your own lab teaches the muscle a SOC analyst uses every shift, without touching production or paying for anything. Do it once on sample…
What you'll learn
- what the ELK stack is (ingest, index, search, visualize)
- standing up Elasticsearch and Kibana with Docker
- indexing log data into Elasticsearch with curl
- searching logs in Kibana with KQL
- building a simple visualization and dashboard
- where a searchable log store fits as a SIEM foundation
Steps in this lab
- What the ELK stack actually is
- Stand it up with Docker
- Confirm Elasticsearch is answering
- Ship some sample logs in
- Open Kibana and point it at your data
- Search with KQL
- Build a visualization and a dashboard
- Where this fits, and what to do next