Log Grep / Filter Playground
Filter a block of log lines with a regex — the exact "find the signal in the noise" skill IR work depends on.
Incident response is mostly reading logs faster than the attacker moved. This page gives you a pile of lines and a regex filter, which is the same loop as grep — narrow, read, narrow again — without needing a shell.
How to use it
- Paste log lines, one per line.
- Enter a case-insensitive regex filter.
- Refine until only the interesting lines remain.
What to take away
Subtract noise before adding signal
Filtering out what you know is routine usually reveals more, faster, than guessing what the attack looks like.
Time is the backbone of every investigation
Once you find one suspicious event, pivot to everything around that timestamp. The story lives in the neighbours.
Absence is evidence
A gap where logs should be, or a service that stopped logging mid-incident, is itself a finding — and often a deliberate one.
Frequently asked questions
What should I grep for first in auth logs?
"Failed password" and "Accepted password" together — a burst of failures followed by an acceptance is a successful brute force, and that pattern is the fastest way to spot one.
How is this different from grep?
It is the same idea in a browser, so you can practise the reasoning before you have a box to run commands on. Real work happens in grep, awk or a SIEM.
Where do I practise on a realistic dataset?
The Log Analysis / IR Lab gives you a messy auth.log from a compromised machine and asks you to reconstruct what happened.
Where this fits in the course
This security tool pairs with Path 03 — Linux — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
- Regex Tester — Test a regular expression against sample text with live match highlighting and capture groups.
- User-Agent String Parser — Break down a User-Agent string into OS, browser, and version — and flag common automated-client patterns.
- Email Header Analyzer — Paste raw email headers and get flagged for From/Return-Path mismatches, SPF failures, and missing DKIM.