Home / Labs / Write the Report

Write the Report

The breach is contained. Write the incident report your manager, legal, and CISO will read.

Open this lab

Commands practised here

• grep 'Accepted' /var/log/auth.logShows all successful logins for the report.
• grep 'Failed' /var/log/auth.log | awk '{print $11}' | sort -uLists attacker IPs for the IOC section.
• grep 'UFW' /var/log/syslogShows firewall decisions for the timeline.
• grep -E 'Failed|Accepted' /var/log/auth.logShows all attack and breach events.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Trace the Web Attack
• Creating Files