Home / Labs / Connect the Dots

Connect the Dots

Three log sources, two attackers. Correlate them to build the complete picture.

Open this lab

Commands practised here

• grep '<IP>' /var/log/syslogFinds all events from a specific IP in syslog.
• grep 'Accepted' /var/log/auth.logShows all successful logins.
• cat /var/log/app.logReads the application log.
• grep '<pattern>' <file> | wc -lCounts matching lines.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Protect the Logs
• Correlate the Logs