Log Analysis / IR Lab
A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
A messy auth.log from a machine that was compromised. No exploitation here — this is the blue-team side: work out what happened, in what order, and where the attacker got in.
How to use it
- Scan for authentication failures and find the burst.
- Locate the success that follows it.
- Build the timeline forward from there — what did they do once inside?
What to take away
Failures then a success is the signature
Many failed passwords followed by an accepted one, from the same source, is a brute force that worked. It is the single most recognisable pattern in auth logs.
Pivot on time, then on identity
Find one confirmed event, examine everything around that timestamp, then follow the account or address wherever it goes.
Persistence is the next question
Attackers add keys, users, cron jobs and services. Finding entry without finding persistence means the incident is not over.
Frequently asked questions
Where do Linux authentication logs live?
/var/log/auth.log on Debian and Ubuntu, /var/log/secure on RHEL and derivatives. Systemd journals hold the same events via journalctl.
What is the first thing to check after a suspected compromise?
Who logged in, from where, and when — then what they ran. Preserve the evidence before changing anything, because remediation destroys the timeline.
Where this fits in the course
This security lab pairs with Path 12 — Network Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Log Grep / Filter Playground — Filter a block of log lines with a regex — the exact "find the signal in the noise" skill IR work depends on.
- Incident Response Tabletop — A branching ransomware scenario. Make the containment and communication calls a real incident commander has to make under pressure.
- Malware Strings Triage Lab — A raw strings dump from a suspicious binary. Spot the IOCs — a C2 domain, a mutex, a registry key — before touching a disassembler.
- Packet Capture Viewer — Load a sample capture and explore protocols, IPs, and payloads — the same "read the traffic" muscle Wireshark builds.