Lion Cipher Lab
10-minute drill: spot the brute force in a short auth log
- SOC Analyst / Blue Team
- Beginner
- ~10 min
- Free · no account required
Why it matters
Spotting a brute-force attempt in an authentication log is one of the first things a SOC analyst is trusted with, and one of the most common things an interviewer puts on screen. The skill is not memorising commands; it is reading twenty lines, seeing the burst that does not belong, and noticing the one line that turns noise into an incident: the success that comes after the failures.
What you'll learn
- reading an SSH auth log line by line
- spotting a password-guessing burst
- noticing a success after many failures
- writing a one-line escalation
Steps in this lab
- The artifact: twenty lines from a server's auth log
- Separate normal from odd
- Find the line that turns noise into an incident
- How to say it out loud