◇ OpenCyber Academy
Technical · Chapter 7 · English

Chapter 7 — Data and telemetry

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Data and telemetry

Lesson map

Lesson 07 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Useful logs"]
  N2["7.2 Access path"]
  N3["7.3 No production dumps"]
  N4["7.4 Confirming findings"]
  N5["7.5 Clock sync"]
  N6["7.6 Detection feedback"]
  N7["7.7 Sample not full export"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Useful logs"]
  N2["7.2 Access path"]
  N3["7.3 No production dumps"]
  N4["7.4 Confirming findings"]
  N5["7.5 Clock sync"]
  N6["7.6 Detection feedback"]
  N7["7.7 Sample not full export"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX025"]

[Learning outcomes]
    |
    v
[7.1 Useful logs]
    |
    v
[7.2 Access path]
    |
    v
[7.3 No production dumps]
    |
    v
[7.4 Confirming findings]
    |
    v
[7.5 Clock sync]
    |
    v
[7.6 Detection feedback]
    |
    v
[7.7 Sample not full export]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) identify logs useful in testing and in detection; (2) request access the right way; (3) avoid dumping production data; (4) use telemetry to confirm findings.

7.1 Useful logs

Logs useful in testing and in detection include web access logs, API auth failures, VPN authentications, WAF blocks and AD sign-ins. For ENG-512 the useful logs are WAF allow/deny, API auth failures, VPN session starts and jump-host commands. Full production dumps are refused; Sam requests WAF and API auth samples only for the ENG-512 clock window. Useful logs are those slices, not multi-day dumps. Asking for the slice in advance, with the window times written in the request, lets the SOC prepare it before Saturday instead of searching during the test.

7.2 Access path

Sam requests read-only log access for the window through the ROE, not by sharing someone else's SIEM password. The access path to logs is read-only through the SOC ticket, not a personal admin role on production, and read-only access is enough. Elevating tst-sam-web to production log admin is refused, even when the SOC is slow to reply to the ticket; Sam's test account never becomes a log-admin shortcut. Access-path discipline limits the blast radius if the test account is ever misused.

7.3 No production dumps

Exporting whole member tables for analysis is out of bounds; use synthetic or minimised samples. No production dumps means no full-table export of trip history to prove a finding, and production trip-table dumps are never a teaching aid. A redacted sample that shows the class of issue is enough for staging-focused ENG-512 work, and it is the maximum Sam will attach. If an owner insists on a larger export, the request goes back to the ROE owner and the privacy contact rather than being settled in the engagement channel.

7.4 Confirming findings

An access-control finding is stronger when logs show the unauthorized request succeeded. Confirming findings with logs means matching timestamps after clock sync. In the synthetic drill, the 401 loop at 10:12 is confirmed when the API logs show the same minute and the jump-host clock agrees with the API hosts within two minutes. Without that agreement, the time in the stop message is not evidence-grade. The worked example below uses the same idea with a request id, which ties the log line to one specific test request.

7.5 Clock sync

Note time zones and NTP status when correlating logs with activity notes. Clock sync between Sam's jump host and the API hosts is checked at kickoff with an NTP check against the API VIP. Skew larger than two minutes is fixed before evidence timestamps, hashes and log comparisons are trusted. Sam writes the measured skew in the activity log, so a reviewer can see that the check was done and how large the difference was. A time zone written beside every timestamp avoids a second class of mistakes when logs from different systems are compared.

7.6 Detection feedback

Share technique names with the SOC so they can build detections after the test. Detection feedback for ENG-512 lists which method cards ran and the time they stopped. Silence after the ENG-512 start is a coordination failure, not a stealth goal; the SOC should never learn that ENG-512 ended only from silence. The feedback note also says which checks the SOC saw and which it missed, so the gaps become detection work rather than surprises in the next window. It is sent the same day the window closes.

7.7 Sample not full export

When a log query returns thousands of lines, Sam exports a time-bounded sample around his test activity, not the whole day, unless the ROE asks for more. For a finding he requests five minutes of API auth logs around it, not a day's dump. Smaller samples protect riders and still confirm the issue, and they also save review time, since a peer can read five minutes of lines in one sitting. The query that produced the sample is saved beside it so the same slice can be pulled again at retest.

7.8 PII in logs

Logs can contain rider names, phone numbers, e-mails, card numbers and precise GPS positions. If a log Sam must keep contains rider phone numbers, he stores it in the restricted vault path and notes the presence of PII in the evidence index. Log redaction removes e-mails, card PANs and precise GPS before screenshots or extracts enter the vault. A log line with a rider e-mail fails minimisation even if the finding is about auth, and PII left in a teaching screenshot fails minimisation too.

7.9 Field discipline

Sam books SIEM access in the same ticket as the ROE, with an end date. When the engagement ends, he confirms his access is removed; leftover read access is itself a finding he would write about anyone else. During the window he saves queries, not raw dumps, so another technician can replay the investigation without holding excess rider data. Field discipline for telemetry is to sample, redact, sync clocks and tell the SOC. Sam's ENG-512 stop message after the 401 loop named the time and the system so detection could correlate.

Worked example (synthetic NMT)

Sam correlates a staging API 200 response on another user's resource with his activity-log time; the app log shows the same request id.

Synthetic case — Northline Municipal Transit (NMT). The transit agency, Sam Park and all figures are invented for teaching.

Errors and limits

Live transit systems and fare equipment are never tested without a separate, specialised authorization. This book uses synthetic data only and grants no authority to test real systems.

Exercises

Synthesis

Telemetry is requested properly, minimised and used to strengthen findings — not to hoard data.

Continue studying — chapter 07 of 18

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →