A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Regular expressions are a language for matching shapes, not a magic security detector. A good log regex represents an observed pattern: an IPv4-like value, an SSH failure phrase, a timestamp field, or a known event code. The first question should be “what does the source really look like?” rather than “how complicated can the regex be?”
Keep expressions maintainable. Group related alternatives, anchor where the format permits, and test edge cases such as missing fields or extra whitespace. If a simple fixed-string search can answer the question, use it. Every extra regex feature increases the number of ways a future parser can disagree with your assumptions.
Matches two known authentication-event forms using anchored alternation. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
Use a test corpus. Store a few positive and negative examples beside the script or in a lab fixture. That turns a regex from tribal knowledge into something you can regression-test when log formats change.
Anchors a timestamp-shaped prefix. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
Selects severity-prefixed records using alternation. In a production workflow, save the raw result when the observation contributes to a finding. That keeps later analysis honest and makes troubleshooting reproducible.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.