Home / Labs / Cross-Reference Sources

Cross-Reference Sources

Three log files, same time window. Cross-reference by timestamp and IP to find the breach.

Open this lab

Commands practised here

• grep '<IP>' /var/log/auth.log /var/log/syslog /var/log/messagesFinds all events from an IP across all logs.
• grep 'UFW' /var/log/syslogShows all firewall decisions.
• awk '{print $1}' /var/log/auth.log | sort -uLists unique timestamps.
• diff <(awk '{print $11}' /var/log/auth.log | sort -u) <(awk '{print $11}' /var/log/syslog | sort -u)Finds IPs unique to one log file.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Contain the Breach
• Eradicate Persistence