Lab 7 — Log Analysis & Incident Response

Threshold-based alerts: "Alert if a user has 5+ failed login attempts in 5 minutes"
Anomaly detection: "Alert if a user logs in from a new geographic location"
Brute force detection: "Alert if 10+ failed logins occur from the same IP in 10 minutes"
Login velocity checks: "Alert if the same user logs in from 2 different IPs within 1 minute"

Cybersecurity Lab Series

Lab 7: Log Analysis & Incident Response

Analyze security logs to detect malicious activity. Learn how to identify threats, create detective controls, and initiate incident response procedures.

📋 Lab Overview

This lab focuses on a core task in security operations: analyzing logs to detect potential malicious activity. You will be provided with a sample log file, identify suspicious entries, explain how security teams are alerted, and outline initial incident response procedures.

✅ Upon completion of this lab, you will be able to:

Identify suspicious activity within a security log file
Explain the importance of logging for a security team
Describe how a detective control can be used to monitor for threats
Outline the initial steps of a basic incident response plan

📦 Materials & Prerequisites:

A computer with internet access
A text editor or word processor for analyzing logs and documenting findings
A method to capture screenshots (built-in OS tools or screenshot software)
A word processor for final submission (Microsoft Word, Google Docs, etc.)