Triage the Logs
SOC alert at 3 AM. Triage the auth.log: failed attempts, suspicious IPs, did anyone get in.
Commands practised here
grep 'Failed password' /var/log/auth.log | wc -lCounts total failed login attempts.grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rnRanks IPs by failed attempt count.grep 'Accepted' /var/log/auth.logShows all successful logins.grep 'Failed' /var/log/auth.log | awk '{print $9}' | sort | uniq -c | sort -rnShows which usernames were targeted.
Nearby labs
- All labsBrowse the full list.
- Exam prepWhich exams these objectives map to.
- Correlate the Logs
- Hunt the Malware