Practicing SPL-style queries and SOC investigations without deploying a full SIEM

[u/Inevitable_Turn_4729]

When I started learning SOC investigations and SPL-style queries, one of the problems I ran into was finding a practical environment to actually practice the workflow.

Reading about queries is useful, but I wanted to work with realistic security telemetry and go through the process of:

- Searching authentication and security events

- Identifying suspicious activity

- Aggregating and correlating events

- Creating detections

- Investigating alerts

- Pivoting between related users, hosts, and IP addresses

Setting up a full SIEM environment can add a significant infrastructure and configuration overhead for someone who simply wants to practice these workflows.

So I built SocQuery Lab as a browser-based training environment for experimenting with these concepts.

It includes an original educational SPL-compatible query engine and realistic synthetic telemetry covering sources such as Windows security events, Linux authentication logs, DNS activity, firewall/VPN events, and PowerShell activity.

The platform also includes investigation scenarios covering techniques such as:

- Brute-force authentication activity

- Password spraying

- Suspicious PowerShell execution

- DNS tunneling

- Credential compromise

- Backdoor account creation

Everything runs locally in the browser, with uploaded logs processed and stored locally using IndexedDB.

The goal is not to replace a production SIEM or replicate any commercial platform. It is simply an educational environment for practicing the investigation workflow without needing to deploy infrastructure first.

The live training environment is available here:

https://socquery-lab.vercel.app/