JSON and jq Quick Start Guide

This guide is a supplement to SANS FOR572: Advanced Network Forensics and Analysis. It covers the basics of JSON and some of the fundamentals of the jq utility. The jq utility filters, parses, formats, and restructures JSON—think of it as sed, awk, and grep, but for JSON. Given the trend toward logs being generated in JSON, easily accessing and molding that data is increasingly important for the forensicator. This document is not intended to replace jq’s extensive documentation. It is only a quick reference resource.