Home / Labs / Separate Signal from Noise

Separate Signal from Noise

The auth.log is massive with legitimate traffic mixed with attacks. Filter the noise and find real threats.

Open this lab

Commands practised here

• grep 'Failed password' /var/log/auth.log | awk '{print $11}' | sort -uLists unique attacker IPs.
• grep 'Accepted publickey' /var/log/auth.log | grep '10.0.0' | wc -lCounts legitimate internal connections.
• grep 'Accepted password' /var/log/auth.logShows all password-based breaches.
• grep -v '10.0.0' /var/log/auth.log | grep 'Failed' | awk '{print $11}' | sort | uniq -c | sort -rnShows attacker IPs excluding legitimate traffic.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Map the Network Footprint
• Expose the Backdoors