The Defender Mindset

The defender mindset

On the blue team the attack has already happened, it is buried in the logs, and your job is to reconstruct exactly what the intruder did — who, what, when, and did they get in?

No fancy SIEM needed. Real analysts live in the shell: grep, awk, sort, uniq, cut. Master those on raw logs and you can investigate almost anything.

🛡️ Safe practice setup

You will analyse logs in an isolated VM you own. Since you do not have a real incident to hand, you generate a realistic sample set yourself. Paste the script below once to create ~/lab-soc/auth.log and ~/lab-soc/access.log — plain text log lines, nothing is attacked. These simulate a single intrusion so you can practise the hunt safely.

mkdir -p ~/lab-soc && cd ~/lab-soc
# --- auth.log: a flood of SSH failures then ONE success (brute force) ---
{
  echo "Jul  2 08:55:03 ssh01 sshd[811]: Accepted password for admin from 192.0.2.9 port 40122 ssh2"
  for i in $(seq 1 60); do
    printf 'Jul  2 09:0%d:%02d ssh01 sshd[%d]: Failed password for invalid user test from 203.0.113.%d port %d ssh2\n' \
      $((RANDOM%9)) $((RANDOM%60)) $((1000+i)) $((RANDOM%255)) $((30000+RANDOM%20000))
  done
  for i in $(seq 1 220); do
    printf 'Jul  2 09:14:%02d ssh01 sshd[%d]: Failed password for admin from 198.51.100.5 port %d ssh2\n' \
      $((i%60)) $((2000+i)) $((51000+i))
  done
  echo "Jul  2 09:14:41 ssh01 sshd[2222]: Accepted password for admin from 198.51.100.5 port 51221 ssh2"
} > auth.log
# --- access.log (nginx combined): a 404 storm then the breach ---
{
  for i in $(seq 1 40); do
    printf '192.0.2.9 - - [02/Jul/2026:08:%02d:%02d +0000] "GET / HTTP/1.1" 200 %d "-" "Mozilla/5.0"\n' \
      $((RANDOM%60)) $((RANDOM%60)) $((300+RANDOM%900))
  done
  for i in $(seq 1 300); do
    printf '198.51.100.5 - - [02/Jul/2026:09:08:%02d +0000] "GET /app%d HTTP/1.1" 404 178 "-" "Mozilla/5.0 (dirb)"\n' \
      $((i%60)) "$i"
  done
  printf '198.51.100.5 - - [02/Jul/2026:09:09:07 +0000] "GET /backup/config.php.bak HTTP/1.1" 200 431 "-" "curl/8.0"\n'
  for s in 401 401 401; do
    printf '198.51.100.5 - - [02/Jul/2026:09:12:%02d +0000] "GET /admin/ HTTP/1.1" %s 178 "-" "curl/8.0"\n' $((RANDOM%60)) "$s"
  done
  printf '198.51.100.5 - - [02/Jul/2026:09:12:59 +0000] "GET /admin/ HTTP/1.1" 200 640 "-" "curl/8.0"\n'
} > access.log
wc -l ~/lab-soc/*.log      # auth.log and access.log are now yours to analyse

Solution (try the challenge first)

wc -l ~/lab-soc/auth.log ~/lab-soc/access.log

Two logs: auth.log (ssh01 authentication) and access.log (web01 HTTP). Your entire investigation lives in these two files.