Log analysis techniques in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to read a log file line by line.

Cybersecurity

with open('system.log', '[1]') as file:
    for line in file:
        print(line.strip())

Drag options to blanks, or click blank then click option'

Awrite

Bdelete

Cappend

Dread

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'write' mode will erase the file contents before reading.

The mode 'read' opens the file for reading its contents line by line.

2fill in blank

medium

Complete the code to filter log lines containing the word 'ERROR'.

Cybersecurity

error_lines = [line for line in log_lines if '[1]' in line]

Drag options to blanks, or click blank then click option'

AERROR

BWARNING

CINFO

DDEBUG

Attempts:

3 left

💡 Hint

Common Mistakes

Filtering by 'INFO' or 'DEBUG' will include less critical messages.

Filtering lines with 'ERROR' helps identify critical issues in logs.

3fill in blank

hard

Fix the error in the code to parse timestamps from log entries.

Cybersecurity

from datetime import datetime

log_time = datetime.strptime(log_entry['timestamp'], '[1]')

Drag options to blanks, or click blank then click option'

A%Y/%m/%d %H:%M:%S

B%Y-%m-%d %H:%M:%S

C%d-%m-%Y %H:%M:%S

D%m-%d-%Y %H:%M:%S

Attempts:

3 left

💡 Hint

Common Mistakes

Using slashes or wrong order causes parsing errors.

The format '%Y-%m-%d %H:%M:%S' matches timestamps like '2024-06-01 14:30:00'.

4fill in blank

hard

Fill both blanks to create a dictionary of IP addresses and their counts from logs.

Cybersecurity

ip_counts = {ip: [1] for ip in ip_list if ip [2] ip_list}

Drag options to blanks, or click blank then click option'

Aip_list.count(ip)

Blen(ip_list)

Cin

Dnot in

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'not in' will exclude IPs instead of including them.

Counting occurrences of each IP with ip_list.count(ip) and checking membership with in builds the dictionary correctly.

5fill in blank

hard

Fill all three blanks to filter logs by severity and create a summary dictionary.

Cybersecurity

summary = [1] for entry in logs if entry['severity'] [2] 'high' and entry['status'] [3] 'open'

Drag options to blanks, or click blank then click option'

A{entry['id']: entry['message']}

B==

C!=

D{entry['message']: entry['id']}

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up keys and values in the dictionary or using wrong comparison operators.

The dictionary comprehension uses {entry['id']: entry['message']} to map IDs to messages, filters where severity is 'high' (==) and status is not 'open' (!=).

Practice

1. What is the primary purpose of log analysis in cybersecurity?

easy

A. To create new log files

B. To detect security issues and system problems

C. To delete old logs automatically

D. To encrypt log data for privacy

Solution

1. Step 1: Understand the role of log analysis

   Log analysis involves reviewing recorded events to find unusual or harmful activities.

2. Step 2: Identify the main goal in cybersecurity context

   The main goal is to detect security threats and system issues early by examining logs.

3. Final Answer:

   To detect security issues and system problems -> Option B

4. Quick Check:

   Log analysis = Detect security issues [OK]

Hint: Logs show system events; analysis finds problems fast [OK]

Common Mistakes:

• Confusing log creation with analysis
• Thinking logs are deleted automatically
• Assuming encryption is the main goal

2. Which of the following commands is commonly used to filter log entries containing a specific keyword in Linux?

easy

A. cat > /var/log/syslog

B. ls -l /var/log/syslog

C. grep 'keyword' /var/log/syslog

D. chmod 777 /var/log/syslog

Solution

1. Step 1: Identify command purpose

   grep searches text for matching patterns, useful for filtering logs.

2. Step 2: Match command to filtering logs

   grep 'keyword' /var/log/syslog filters lines containing 'keyword' from the log file.

3. Final Answer:

   grep 'keyword' /var/log/syslog -> Option C

4. Quick Check:

   grep filters text by keyword [OK]

Hint: Use grep to find keywords in logs quickly [OK]

Common Mistakes:

• Using ls which lists files, not content
• Using cat > which overwrites files
• Using chmod which changes permissions

3. Given the following log entries, what will the command grep 'ERROR' logfile.txt | wc -l output?

INFO User login
ERROR Disk full
WARNING CPU high
ERROR Network down
INFO Shutdown

medium

A. 2

B. 3

C. 1

D. 0

Solution

1. Step 1: Identify lines containing 'ERROR'

   From the log, lines 2 and 4 contain 'ERROR'.

2. Step 2: Count matching lines with wc -l

   There are 2 lines with 'ERROR', so the command outputs 2.

3. Final Answer:

   2 -> Option A

4. Quick Check:

   grep 'ERROR' lines count = 2 [OK]

Hint: Count lines with 'ERROR' using grep and wc -l [OK]

Common Mistakes:

• Counting all lines instead of filtered ones
• Confusing grep output with total lines
• Ignoring case sensitivity if not specified

4. A security analyst runs the command cat /var/log/auth.log | grep sshd but gets no output, even though there should be sshd entries. What is the most likely reason?

medium

A. The user lacks permission to read the log file

B. The grep command is misspelled

C. The log file is empty

D. The sshd service is not running

Solution

1. Step 1: Check command correctness

   The command syntax is correct and grep is spelled properly.

2. Step 2: Consider permission issues

   If the user cannot read the log file, no output appears despite entries existing.

3. Final Answer:

   The user lacks permission to read the log file -> Option A

4. Quick Check:

   Permission denied causes no output [OK]

Hint: Check file permissions if grep returns no output [OK]

Common Mistakes:

• Assuming the log file is empty without checking
• Blaming grep spelling without verification
• Ignoring user permission issues

5. You want to analyze a large log file to find all failed login attempts within the last 24 hours. Which combination of techniques is best suited for this task?

hard

A. Encrypt the log file before analysis to protect data

B. Manually open the log file and scroll to recent entries

C. Delete old logs and keep only the last 24 hours of data

D. Use a script to parse timestamps and filter entries with 'failed login' keyword

Solution

1. Step 1: Understand the need to filter by time and keyword

   Finding failed logins in last 24 hours requires filtering by timestamp and keyword.

2. Step 2: Choose an efficient method

   A script can parse timestamps and filter 'failed login' entries automatically and accurately.

3. Final Answer:

   Use a script to parse timestamps and filter entries with 'failed login' keyword -> Option D

4. Quick Check:

   Script parsing timestamps + keyword = best approach [OK]

Hint: Automate filtering by time and keyword with a script [OK]

Common Mistakes:

• Trying manual scrolling which is slow and error-prone
• Deleting logs loses important data
• Encrypting logs before analysis prevents reading