How SOC Analysts Use sed to Catch Attacks Before the SIEM Does

The sed Command for SOC Analysts: A Field Guide to Fast Log Triage During Incident Response

Quick Answer: sed is a stream editor that lets SOC analysts filter, redact, and reformat log files instantly from the command line — no SIEM query required. Master the syntax below to triage incidents before your dashboards even finish indexing.

It's 2:14 AM. Your SIEM dashboard is still crunching yesterday's ingest backlog, but the on-call pager just fired: a web-facing login endpoint is throwing anomalous error volume. You don't have thirty minutes to wait for Splunk to catch up. You have SSH access to the box and a 400MB auth.log file sitting right there. This is the exact moment where sed — a forty-plus-year-old Unix utility — becomes more useful than any enterprise SIEM log correlation platform on your network.

Most junior analysts learn grep first and stop there. But grep only finds lines — it can't rewrite them, strip sensitive fields before you paste output into a ticket, or replace a stream of raw text on the fly. That's sed's job, and it's a core part of any serious Linux log analysis for SOC analysts toolkit. This guide walks through the full syntax with the specific defensive use cases — SQL injection triage, PII redaction, log normalization — where it earns its place next to your EDR agent.

Table of Contents

• What sed Actually Does
• Core Syntax: Search, Replace, Delete, Print
• Real-World Scenario: Triaging a Brute-Force and SQLi Wave
• Full Command Reference
• Detection and Prevention Workflow Tips
• Expert Tips
• FAQ
• Conclusion

What sed Actually Does (And Why It Matters for Incident Response)

sed stands for stream editor. It reads text line by line and applies an editing instruction — substitute, delete, print, insert — without opening a file in an editor or loading it fully into memory. For a SOC analyst, that non-interactive, scriptable nature is the whole point: you can pipe live tail -f output through sed, chain it after grep and awk, or run it across dozens of rotated log files in a single incident-response one-liner.

It's also POSIX-standard, meaning it behaves consistently across nearly every Linux distribution and most BSD/macOS systems you'll ever SSH into — a small but real advantage when you're working an incident on unfamiliar infrastructure under time pressure.

Core Syntax: Search, Replace, Delete, Print

Every sed command follows a simple shape: sed 'ADDRESS COMMAND' file. The address tells sed which lines to act on (a line number, a range, or a pattern); the command tells it what to do.

Substitution — the workhorse

sed 's/old/new/' file.txt

Replaces the first match of "old" with "new" on each line. To replace every match, add the global flag:

sed 's/old/new/g' file.txt

Add i for case-insensitive matching — useful when attackers mix case to dodge simple string searches:

sed 's/old/new/gi' file.txt

Printing specific lines

sed -n '3p' file.txt

The -n flag suppresses automatic output, and p prints only the matched line — here, line 3. Use a range the same way:

sed -n '3,7p' file.txt

Or print every line matching a pattern instead of a line number — this is the pattern you'll use most during triage:

sed -n '/error/p' file.txt

Deleting noise

sed '/^$/d' file.txt

Strips blank lines. Combine with a pattern to drop irrelevant entries entirely, such as verbose debug logging that's burying the signal you actually need:

sed '/error/d' file.txt

Real-World Scenario: Triaging a Brute-Force and SQLi Wave

Back to that 2:14 AM page. Here's how the investigation actually unfolds using nothing but sed, grep, and a terminal.

Step 1 — Confirm the anomaly is real. Pull just the failed authentication lines without wading through successful logins:

sed -n '/Failed password/p' /var/log/auth.log

Step 2 — Check for SQL injection probing on the web tier. A classic first move for an attacker hitting a login form is to test for unsanitized input. You can surface every request line containing an injection-style keyword before your WAF logs even sync to the SIEM:

sed -n '/SELECT/p' access.log

In practice, analysts pair this with grep -Ei for full injection patterns (' OR 1=1 -- and similar), but sed's pattern-print mode is faster when you already know the keyword you're hunting.

Step 3 — Redact before you escalate. You're about to paste twenty lines of raw log into a ticket for your Tier 2 lead or attach it to a compliance report. Those lines contain internal IP addresses and possibly usernames that shouldn't leave the SOC unredacted. Normalize the log first:

sed 's/^[A-Za-z]\{3\} [ 0-9]\{2\} [0-9:]\{8\} //' /var/log/syslog

This strips the BSD-style syslog timestamp prefix (e.g., May 20 14:12:10) so what's left is the clean event body — easier to scan and easier to hand off. If you're on RFC 5424 / ISO-timestamped logs, the regex needs adjusting to match that format instead.

Step 4 — Edit the evidence copy, never the source. This is the part junior analysts get wrong most often: they run -i (in-place edit) directly against the live evidence file. Don't. Always work on a copy, or at minimum take a backup pass:

sed -i.bak 's/old/new/g' file.txt

This edits the file directly but preserves the original as file.txt.bak — a small habit that protects chain-of-custody integrity if this incident ever needs to hold up in a post-mortem or legal review.

Full Command Reference

Command	What It Does
sed 's/old/new/'	Replace first match per line
sed 's/old/new/g'	Replace all matches per line
sed 's/old/new/gi'	Case-insensitive global replace
sed '2d'	Delete line 2
sed '2,5d'	Delete lines 2–5
sed '1d'	Delete the first line
sed '$d'	Delete the last line
sed '/^$/d'	Delete blank lines
sed '/error/d'	Delete lines matching "error"
sed -n '3p'	Print only line 3
sed -n '3,7p'	Print lines 3–7
sed -n '/error/p'	Print only matching lines
sed -n '='	Print line numbers
sed -i 's/foo/bar/g'	Edit file in place
sed -i 's/old/new/g' file1.txt file2.txt	Edit multiple files at once
sed '3s/old/new/'	Replace only on line 3
sed '2,5s/old/new/g'	Replace within a line range
sed '3i\New line'	Insert text before line 3
sed '3a\New line'	Insert text after line 3
sed '3c\New content'	Replace an entire line
sed 's/^[[:space:]]*//'	Strip leading whitespace
sed 's/[[:space:]]*$//'	Strip trailing whitespace
sed 's/[[:space:]]\+/ /g'	Collapse repeated spaces
sed 's/,/ /g'	Convert commas to spaces (CSV cleanup)
echo "hello" | sed 's/world/Linux/'	Filter piped command output
sed 's/old/new/g' file.txt > newfile.txt	Save output to a new file
sed -i.bak 's/old/new/g'	Edit in place with a backup
sed -e 's/foo/bar/g' -e 's/test/demo/g'	Chain multiple substitutions

A note on destructive use: sed -i overwrites the target file with no undo beyond the .bak copy you explicitly requested. Never run -i against a primary log source during an active investigation — work from a copy in a scratch directory instead.

Detection and Prevention Workflow Tips

• Build a redaction pass into your ticketing SOP. A one-line sed substitution that masks the last two octets of an IP (sed -E 's/([0-9]+\.[0-9]+)\.[0-9]+\.[0-9]+/\1.x.x/g') keeps shared tickets and vendor escalations compliant with internal data-handling policy.
• Chain, don't replace, your other CLI tools. grep for candidate lines, sed to reshape them, awk to tabulate counts — this three-tool pipeline remains one of the fastest ways to go from raw log to actionable indicator, and it works identically whether you're staring at a laptop or SSH'd into a cloud instance with no endpoint detection and response agent installed yet.
• Use it to pre-clean data before it hits your SIEM. Normalizing timestamp formats or stripping known-benign noise with sed before ingest reduces false-positive volume downstream — a small win that compounds across a high-alert-volume enterprise SOC.
• Document the exact command you ran. Because sed edits are non-interactive and easy to paste verbatim into a case note, they're also easy to reproduce for a second analyst validating your findings — good practice for any incident response automation workflow you're building toward.

Expert Tips

• Test destructive substitutions with sed 's/.../.../' (no -i) first and eyeball the output before you ever add the in-place flag.
• On macOS, BSD sed requires an explicit backup extension argument even if you don't want one: sed -i '' 's/old/new/'. GNU sed on Linux does not need the empty quotes. This trips up analysts moving between a Linux SOC workstation and a macOS incident host.
• For anything beyond simple substitution — multi-line matches, lookaheads — reach for perl -pe or Python instead of fighting sed's limited regex dialect.

Related Cybersecurity Topics You Should Explore

• Linux tr Command Tutorial: Fix Messy SOC Logs in Seconds
  
• Linux tee Command: The SOC Trick That Saves Evidence Before It's Gone
  
• Linux wc Command Tutorial: Count Log Lines Like a SOC Pro
  
• Linux cmp Command Explained: Every Flag SOC Teams Actually Use
  
• Linux diff Command Tutorial: Detect Config Drift Like a SOC Analyst
  
• Linux uniq Command: 6 Log Analysis Tricks SOC Analysts Use

FAQ

Is sed available on every Linux distribution by default?
Yes — as a POSIX-standard utility, sed ships on virtually every Linux distribution and macOS by default, though macOS uses the BSD variant with slightly different flag behavior than GNU sed.

Can sed replace a SIEM for log analysis?
No. sed is a fast, local triage tool for individual files during hands-on investigation; it doesn't correlate events across sources, retain history, or generate alerts the way a SIEM does.

What's the difference between sed and awk?
sed is built for line-based search-and-replace and filtering; awk is built for field-based processing, such as summing a column of response times or counting occurrences per field.

Is it safe to run sed -i on a log file during an active incident?
Generally no — work on a copy or use -i.bak so the original evidence remains intact for chain-of-custody purposes.

How do I make a sed substitution case-insensitive?
Append the i flag: sed 's/pattern/replacement/gi'.

Can sed process a live, continuously growing log file?
Not directly — sed processes a stream once and exits. Pipe tail -f into sed instead: tail -f app.log | sed 's/ERROR/⚠ ERROR/'.

Why does my sed command work on Linux but fail on macOS?
Most commonly it's the in-place edit flag — BSD sed on macOS requires an explicit (even empty) backup suffix argument after -i, while GNU sed does not.

Conclusion

SIEM platforms, EDR agents, and SOAR playbooks get the budget and the vendor demos, but the fastest tool in an incident is often still the one built into every shell you'll ever touch. sed won't replace your enterprise stack, and it isn't meant to — but as a first-response filter for confirming an anomaly, redacting evidence before escalation, or normalizing logs before ingest, it remains one of the highest-leverage skills a SOC analyst can carry into a 2 AM page.

Analysis based on SOC monitoring and public threat intelligence review.