Home / Labs / The First Five Minutes

The First Five Minutes

SOC alert at 04:00 AM. You are the first responder. You have five minutes to understand what happened.

Open this lab

Commands practised here

• idShows your user and group IDs.
• grep 'Failed password' /var/log/auth.log | wc -lCounts total failed login attempts.
• grep 'Accepted password' /var/log/auth.logShows all successful password logins.
• grep 'UFW' /var/log/syslogShows all firewall decisions.
• grep 'Failed' /var/log/auth.log | awk '{print $11}' | sort -uLists unique attacker IPs.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Uncover Hidden Files
• Forensic Disk Capture