Lion Cipher Lab
Read your first log file and spot something odd
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
Reading logs is the bedrock of defensive security. A log is the record of what actually happened on a machine — who logged in, what failed, when. On a SOC (Security Operations Centre) team, one of the very first things a junior analyst does is open a log and answer "is this normal, or is something wrong?" The single most common thing to spot is a brute-force attempt: someone guessing passwords over and over, which shows up as a flood of failed logins. Learn to see that pattern on your own machine and you have a real, employable, day-one blue-team skill.
What you'll learn
- reading Linux logs
- /var/log
- journalctl
- grep filtering
- spotting brute-force attempts
Steps in this lab
- What a log is, and where Linux keeps them
- Open the authentication log
- Find the login events — successes and failures
- Now filter for FAILED logins — the interesting ones
- Read the same events with journalctl
- What a brute-force attempt actually looks like
- Why this small skill is a big deal