Lion Cipher Lab
Detect anomalies in logs with Python
- Cyber / Security Engineer
- Beginner
- ~40 min
- Free · no account required
Why it matters
Counting failed logins is useful; knowing which count is abnormal is where detection begins. Analysts drown in logs precisely because everything looks the same at a glance — thousands of lines, all a little noisy. A tiny bit of statistics turns that noise into a question a computer can answer: given what normal looks like, which values stick out? That single move — describe normal with a mean and a spread, then flag departures from it — is the foundation under a huge amount of real security tooling, from simple alert rules to full machine-learning anomaly detection. Learning it by hand, on…
What you'll learn
- basic statistics for security
- computing a mean and standard deviation
- the 3-sigma rule for outliers
- reading a CSV with Python
- counting events per IP
- flagging outliers in a log
- understanding statistical thresholds and their limits
- the core idea behind ML anomaly detection
Steps in this lab
- The idea: let statistics point at what does not fit
- Make a sample login log to practise on
- Count the failed logins per IP
- Describe normal with two numbers: mean and standard deviation
- The 3-sigma rule: draw the line for unusual
- Put it together: the anomaly flagger
- The honest limits: unusual is not the same as malicious
- Where this grows up: the seed of ML anomaly detection
- What you just proved