Lion Cipher Lab
Slice and query JSON logs with jq
- SOC Analyst / Blue Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
The logs a defender reads today are mostly JSON, not plain text. Cloud platforms (AWS, Azure, Google Cloud), Kubernetes, and a huge range of security tools all write their events as JSON, because a machine-readable format is easy for other machines to search and ship around. The catch is that grep — the classic line-by-line text filter — is clumsy on JSON, because the meaning lives in named fields, not in a line's position. jq is the small, universal tool built exactly for this: it lets you pick fields, filter events, and count patterns out of JSON in one line. Learn it once and you can…
What you'll learn
- reading JSON
- jq basics
- selecting fields
- nested fields
- filtering with select()
- group_by and length
- building log-triage one-liners
Steps in this lab
- What JSON is, in plain words
- Open a terminal and install jq
- Make a sample JSON log to practise on
- Pretty-print the log — meet the filter and the pipe
- Select fields, including nested ones
- Filter to just the events that matter with select()
- Count and group — how many, and by what
- Build the one-liner that pulls suspicious events out
- Why this small skill travels so far