This lab explores raw network device log analysis. You will evaluate command-line interface (CLI) tools used by analysts to parse through high-velocity data streams directly on infrastructure hardware.
You are a SOC Analyst at Spade Systems. Over the last 15 minutes, users have reported intermittent access drops to the internal finance server (10.0.40.22). SIEM log ingestion from the core network is currently delayed by 5 minutes due to an ingestion pipeline queue. To get immediate situational awareness, you SSH directly into the core Cisco IOS router. The logging buffer is overflowing with noisy routing updates, NAT translations, and general system messages. You suspect ACL 210 is dropping the traffic.
Current logging buffer state on Core-Router-01 (Output of raw show logging without filters):
SOC Note: Issuing a bare show logging will flood your terminal. You must filter the output string locally on the router to only view entries generated by "210".
grep. Which Cisco IOS keyword acts identically to grep by matching a specific string pattern within the piped output?
During a live incident, SIEM pipelines can occasionally experience lag, or you may need to verify the ground truth directly on the infrastructure. By jumping directly onto the core router (likely running Cisco IOS or a similar NOS), you are bypassing the SIEM entirely. Because network devices generate immense volumes of telemetry, printing the entire buffer is useless. You must use CLI text processing—specifically piping (|)—to filter the noise down to the exact Access Control List (ACL 210) causing the drops.
In standard network operating systems like Cisco IOS, the pipe operator (|) directs the output of a command into a text filter. The keyword include is the direct equivalent of the Linux grep command. By typing show logging | include 210, the router will parse the memory buffer and only print lines to your terminal screen that explicitly contain the string "210".
access, forward, and route are not valid text-filtering arguments for the pipe operator in this context. While these are network terms, they are used for routing protocols or interface configuration, not for parsing standard output streams.As a SOC Analyst, you will jump between many different operating systems. You must know the local text-filtering syntax for each. They all achieve the exact same goal: pattern matching.
Want to master more SOC investigations?
Explore more CSA simulations by ExamRange