Home / Labs / Threat Hunter: Incident Report

Threat Hunter: Incident Report

The investigation is over. Write the incident report for the CISO, legal, and the board.

Open this lab

Commands practised here

• grep 'Accepted' /var/log/auth.logShows all successful logins.
• grep 'Failed' /var/log/auth.log | awk '{print $11}' | sort -uLists unique attacker IPs.
• ls -la /etc/cron.d/Lists cron jobs including hidden backdoors.
• grep -E 'Failed|Accepted' /var/log/auth.logShows all attack events.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Verify Against Threat Intel
• Build the IOC List