Read a Linux auth log
Read the authentication log of a Linux server: spot the password-guessing run, find the account an attacker created after getting in, and tell it from the nightly backup that only looks alarming.
Part of the path Security analyst starter (step 2 of 4), next: Review sign-in logs
What you will do
3 tasks1.Spot the password-guessing run
Open web01: failed logins, then a success.
2.Find what they changed
Open web01: what happened after the login.
3.Respond to the break-in
Choose the responses for the break-in on web01: end the attacker's session, block the address, reset the password they used, report it and lock the new account.