A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A log detector is a classifier, not an oracle. A pattern can raise suspicion without proving malicious activity. For example, repeated SSH failures from one address may indicate an automated attack, a broken monitoring system, or a user who mistyped a password many times. Good detectors report the pattern and the evidence that triggered it.
Aggregate before alerting when the signal requires a count or rate. Use `awk` or shell counters to group records, then apply a threshold. Keep the threshold visible in the script rather than burying it in a complex regular expression. That makes tuning much easier when a real environment produces false positives.
Collects a raw candidate set for authentication failures on systems that use this log. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
The command output shown here is a training fixture description. On a live system, verify the actual output rather than assuming it matches the example.
Privilege events also need context. A successful `sudo` entry is not suspicious by itself. The user, command, time, and surrounding activity determine whether the event deserves attention. A detector should narrow the candidate set; an analyst still evaluates intent and authorization.
Preserves privilege-related events for a second analysis stage. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.