Home / Labs / Protect the Logs

Protect the Logs

Root breach caught. Back up the logs before the attacker wipes them. Hash for chain of custody.

Open this lab

Commands practised here

• cat /var/log/auth.logShows all authentication attempts - failed and successful.
• cat /var/log/syslogShows firewall decisions - what got through and what was blocked.
• cat /var/log/messagesShows application-level actions after login.
• cat /evidence/backup-manifest.txtShows backup hashes, line counts, and chain of custody data.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Build the IOC List
• Connect the Dots