Lion Cipher Lab
Set up Graylog and centralize your logs
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Every investigation stands on centralized logs, but there is a real step up from a lean log store to a full log-management platform. Graylog is where a SOC learner crosses that line: it does not just store and search logs, it lets you route a class of messages into a Stream and then define an Event that detects a condition and alerts on it — the collect-store-search-ROUTE-DETECT loop that a lean store like Loki deliberately leaves to you. Standing Graylog up yourself teaches three things that transfer to any SIEM: centralizing logs off the host is what makes them tamper-evidence during an…
What you'll learn
- what a log-management/SIEM platform is and how Graylog is built (Graylog server + MongoDB + a Data Node running OpenSearch)
- standing the whole stack up with the official Graylog Docker Compose
- generating the required password secret and admin password hash
- opening the web UI and creating an Input (Syslog UDP and GELF)
- shipping real logs in: forwarding host syslog and sending a structured GELF message
- searching and filtering messages in the Graylog UI
- building a Stream that routes a class of messages by rule
- creating an Event Definition with an aggregation condition to alert on repeated failed SSH logins
- the when/why/better: when a full SIEM beats grep/journalctl or Loki, why off-host logs are tamper-evidence, and why to structure logs instead of dumping raw text
- tearing the stack down cleanly
Steps in this lab
- What Graylog is, and when a full SIEM is worth it
- Stand up the stack with the official Docker Compose
- Open the web UI and log in
- Create an Input so Graylog can receive logs
- Ship real logs in: host syslog and a structured GELF message
- Search and filter in the UI
- Build a Stream that routes a class of messages
- Detect and alert: an Event Definition on repeated failed logins
- The pro move, and tear it down