Lion Cipher Lab
Write a Python brute-force detector for auth.log
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A busy Linux server can log thousands of failed SSH logins a day, and scrolling them by eye is hopeless. The move that separates a defender from a spectator is writing a few lines of code that read the raw log for you and hand back a short, ranked list of who is hammering the door. This lab teaches that move on the most common real signal there is — SSH brute force — and the exact same shape (read → extract → count → rank → threshold) is how log detection is written everywhere, from a five-line script to a SIEM rule. Learn it once here and you can point it at web logs, firewall logs, anything.
What you'll learn
- running your first Python script
- reading a file line by line in Python
- variables, loops, and if-statements
- extracting an IP with a regular expression (re.search)
- counting per key with collections.Counter
- ranking with most_common()
- turning a threshold into an automated alert
- the shape of a real SSH brute-force attack in auth.log
Steps in this lab
- What we're building, and why the log looks the way it does
- Get Python on your machine (or confirm it's already there)
- Make the sample log to practise on
- First code: read the file and count the failures
- Pull the IP out of a line with a regex
- Count per IP with collections.Counter
- Rank the suspects and raise the alert
- What you just proved — and where to point it next