Every SOC analyst has had this moment: a raw log file lands with zero parser support, thousands of lines deep, and the clock is already running.
Most people open a spreadsheet. The faster move is a command that's been sitting on every Unix-like system for decades: cut.
cut isn't flashy. It doesn't detect anything or correlate events. What it does is take a line of text and hand you back exactly the piece you asked for — a character range, a byte range, or a delimited field — in one line, with no script required.
Here's what I cover in the full writeup:
▸ Cutting by character and byte position — for fixed-width logs and legacy formats where there's no clean delimiter
▸ Cutting by field and delimiter — the mode you'll actually use daily, for CSVs, colon-separated files, and piped command output
▸ A real triage walkthrough parsing /etc/passwd — pulling usernames, home directories, and shells to spot persistence indicators
▸ Exactly where cut's limits are, and the point where awk becomes the better tool
It's written from the analyst's side of the terminal, not a man-page rewrite — real one-liners, real reasoning for when to reach for each option.
If you spend any real time on the Linux command line, security-focused or not, this is a small tool that pays for itself constantly.
Full tutorial: https://www.xpert4cyber.com/2026/09/linux-cut-command-tutorial.html
Top comments (0)