Practice SIEM query vocabulary: SPL, KQL, correlation rules, false positive rates, and log retention queries used in SOC environments.
0 / 10 completed
1 / 10
An analyst says 'we wrote a SPL query to find failed logins'. What platform uses SPL?
SPL stands for Search Processing Language and is the query language native to Splunk. It allows analysts to search, filter, and visualise events stored in Splunk indexes, for example: index=auth action=failure | stats count by user.
2 / 10
'The KQL query returns all events from this IP.' What SIEM platform uses KQL?
KQL (Kusto Query Language) is used by Microsoft Sentinel and Azure Monitor Logs. Analysts use KQL to query log analytics workspaces, for example: SigninLogs | where IPAddress == '1.2.3.4'.
3 / 10
A detection engineer says 'the correlation rule triggers when there are 5 failed logins followed by a success within 10 minutes from the same user'. What does this correlation rule detect?
This correlation rule describes a classic brute force pattern — multiple failed authentication attempts followed by a success suggests an attacker eventually guessed the correct credentials. Correlation rules combine multiple events over a time window to detect multi-step attack patterns.
4 / 10
'The detection rule has a 2% false positive rate.' What does this mean?
A 2% false positive rate means that 2 out of every 100 alerts generated by this rule turn out to be benign — not a real threat. Lower false positive rates mean higher-quality detections and less analyst time wasted on noise.
5 / 10
'The query runs against 7 days of logs.' Why is log retention period important for SIEM queries?
Log retention defines how far back analysts can investigate. If the retention window is 7 days, analysts cannot query events older than that. Shorter retention limits threat hunting and forensic investigation capability — many organisations retain 30-90 days of hot data and archive the rest.
6 / 10
Sarah from the Security Operations team sent this Slack message: 'Just ran a Sumo Logic query to investigate potential lateral movement. It's pulling logs from our web servers and VPC endpoints – seems promising!' What SIEM platform is Sarah likely using?
Sumo Logic uses a query language similar to SPL (Search Processing Language). While Splunk is also a popular SIEM, Sumo Logic's messaging and feature set often emphasize its native capabilities for log aggregation and analysis across cloud environments. Elasticsearch is primarily a search engine; Graylog focuses on log management.
7 / 10
Reviewer: 'This PR description doesn't clearly state what the KQL query is searching for. It just says 'Investigating suspicious network traffic.' We need to be more specific! Consider adding something like, 'Filtering for outbound connections exceeding 10GB within a 5-minute window to known malicious domains.'
A good PR description in a SIEM context needs to clearly articulate the *purpose* and *technical details* of the KQL query. Simply stating 'investigating suspicious network traffic' is too vague; it doesn't convey what the query is actually doing or why it's relevant. The reviewer is correctly highlighting the need for specific syntax information.
8 / 10
API Response (from a SIEM platform's reporting endpoint): `{"query_results": [{"event_time": "2024-10-27T10:30:00Z", "source_ip": "192.0.2.1", "category": "Network Traffic", "bytes_transferred": 15000000}, {...}]}`
What does the `bytes_transferred` field indicate in this API response?
The `bytes_transferred` field represents the amount of data – in bytes – that was transmitted by the specified `source_ip` within the given `event_time`. This is a key metric for identifying potential anomalous network activity. The other options relate to different aspects of an SIEM event.
9 / 10
PR Description: 'Updated the alert rule to include a time window for detecting Command and Control (C&C) activity. Now it triggers when there are 3 or more failed login attempts from the same IP within 60 seconds, followed by a successful login.' What is the primary purpose of the 'time window' in this alert rule?
The 'time window' is a crucial component in mitigating false positives. Without it, a legitimate user experiencing temporary connectivity issues could trigger the rule repeatedly. The defined time limit allows for a more accurate assessment of potentially malicious behavior by considering the sequence and timing of events.
10 / 10
Lead Engineer (during daily stand-up): 'I'm currently running a query against 30 days of logs to investigate a potential data exfiltration attempt. The SIEM platform is using a rolling 7-day retention policy, so we're only analyzing events from the last week.' Why is log retention period important for SIEM queries?
Log retention periods are critical because SIEM queries often rely on temporal relationships between events. A rolling window (like a 7-day retention) allows the system to correlate events that occurred within that timeframe – crucial for detecting complex attacks like data exfiltration where activity might span several days. Longer retention provides more historical context.
What will I learn from the "SIEM Query Vocabulary" exercise?
Practice SIEM query vocabulary: SPL, KQL, correlation rules, false positive rates, and log retention queries used in SOC environments.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this SOC Operations Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss soc operations language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more SOC Operations Language exercises?
See the full SOC Operations Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.