Log forensics in Cybersecurity - Mini Project: Build & Apply

Log Forensics Basics

📖 Scenario: You are a cybersecurity analyst investigating a suspicious activity on a company server. You have access to a log file that records user actions with timestamps and IP addresses.Your task is to analyze the log entries to identify any unusual login attempts based on a threshold of failed attempts.

🎯 Goal: Build a simple log analysis setup that stores log entries, sets a threshold for failed login attempts, counts failed attempts per IP, and identifies IPs exceeding the threshold.

📋 What You'll Learn

Create a dictionary called log_entries with exact entries for user login attempts

Add a variable called failed_attempt_threshold set to 3

Use a for loop with variables ip and status to iterate over log_entries.items() and count failed attempts per IP

Create a list called blocked_ips that contains IPs with failed attempts greater than the threshold

💡 Why This Matters

🌍 Real World

Cybersecurity analysts use log forensics to detect unauthorized access attempts and protect systems from attacks.

💼 Career

Understanding how to analyze logs and identify suspicious patterns is essential for roles like security analyst, incident responder, and network administrator.

1

Create the log entries dictionary

Create a dictionary called log_entries with these exact entries: '192.168.1.10': 'success', '192.168.1.11': 'failed', '192.168.1.12': 'failed', '192.168.1.11': 'failed', '192.168.1.13': 'success', '192.168.1.11': 'failed'

Cybersecurity

# Create the log_entries dictionary with the specified IPs and statuses
# Your code here

Hint

Use a dictionary with IP addresses as keys and login status as values. Duplicate keys will overwrite previous entries, so consider this in your approach.

2

Set the failed attempt threshold

Add a variable called failed_attempt_threshold and set it to 3

Cybersecurity

log_entries = {
    '192.168.1.10': 'success',
    '192.168.1.11': 'failed',
    '192.168.1.12': 'failed',
    '192.168.1.13': 'success'
}
# Set the failed_attempt_threshold variable to 3
# Your code here

Hint

This variable will help decide when to flag an IP for too many failed attempts.

3

Count failed login attempts per IP

Create a dictionary called failed_attempts to count failed logins. Use a for loop with variables ip and status to iterate over log_entries.items(). For each status equal to 'failed', increase the count for that ip in failed_attempts

Cybersecurity

log_entries = {
    '192.168.1.10': 'success',
    '192.168.1.11': 'failed',
    '192.168.1.12': 'failed',
    '192.168.1.13': 'success'
}
failed_attempt_threshold = 3
# Create failed_attempts dictionary and count failed logins per IP
# Your code here

Hint

Use a dictionary to keep counts and the get method to handle new IPs.

4

Identify IPs exceeding the failed attempt threshold

Create a list called blocked_ips that contains IPs from failed_attempts with counts greater than failed_attempt_threshold

Cybersecurity

log_entries = {
    '192.168.1.10': 'success',
    '192.168.1.11': 'failed',
    '192.168.1.12': 'failed',
    '192.168.1.13': 'success'
}
failed_attempt_threshold = 3
failed_attempts = {}
for ip, status in log_entries.items():
    if status == 'failed':
        failed_attempts[ip] = failed_attempts.get(ip, 0) + 1
# Create blocked_ips list with IPs exceeding the threshold
# Your code here

Hint

Use a list comprehension to filter IPs with too many failed attempts.

Practice

1. What is the main purpose of log forensics in cybersecurity?

easy

A. To create new logs for system monitoring

B. To delete unnecessary log files

C. To analyze recorded events to understand system activity

D. To encrypt user data for privacy

Solution

1. Step 1: Understand the role of logs

   Logs record events and activities happening in a system.

2. Step 2: Identify the goal of log forensics

   Log forensics uses these records to analyze and understand what happened in the system, especially for security investigations.

3. Final Answer:

   To analyze recorded events to understand system activity -> Option C

4. Quick Check:

   Log forensics = analyze events [OK]

Hint: Log forensics means studying logs to find what happened [OK]

Common Mistakes:

• Confusing log creation with log analysis
• Thinking log forensics deletes logs
• Assuming log forensics encrypts data

2. Which of the following is a correct example of a log entry timestamp format?

easy

A. 2024-06-01T14:23:45Z

B. 14/23/2024 06:01

C. June 31, 2024 25:61

D. 2024-13-01 14:23:45

Solution

1. Step 1: Recognize standard timestamp formats

   ISO 8601 format like YYYY-MM-DDTHH:MM:SSZ is widely used in logs.

2. Step 2: Check each option for validity

   2024-06-01T14:23:45Z matches ISO 8601 correctly. Options A, B, and D have invalid dates or times.

3. Final Answer:

   2024-06-01T14:23:45Z -> Option A

4. Quick Check:

   Valid ISO 8601 timestamp = 2024-06-01T14:23:45Z [OK]

Hint: Look for YYYY-MM-DDTHH:MM:SSZ format [OK]

Common Mistakes:

• Choosing dates with invalid months or days
• Confusing time order or format
• Ignoring the 'T' and 'Z' in ISO format

3. Given this log snippet:

2024-06-01T10:00:00Z UserA login success
2024-06-01T10:05:00Z UserB login failure
2024-06-01T10:10:00Z UserA logout

What event happened at 10:05?

medium

A. UserA logged out

B. UserB login failed

C. UserA login success

D. UserB logged out

Solution

1. Step 1: Locate the timestamp 10:05:00Z in the log

   The second line shows the event at 10:05:00Z.

2. Step 2: Read the event description

   It says "UserB login failure", meaning UserB tried to log in but failed.

3. Final Answer:

   UserB login failed -> Option B

4. Quick Check:

   10:05 event = UserB login failure [OK]

Hint: Match exact timestamp to event description [OK]

Common Mistakes:

• Mixing up users and actions
• Reading wrong timestamp line
• Assuming success instead of failure

4. A log file shows repeated entries like:

2024-06-01T12:00:00Z UserX login success
2024-06-01T12:00:00Z UserX login success
2024-06-01T12:00:00Z UserX login success

What is the most likely issue with this log?

medium

A. Log file is encrypted

B. The system clock is incorrect

C. UserX logged in multiple times simultaneously

D. Duplicate log entries due to logging error

Solution

1. Step 1: Observe repeated identical log entries

   Multiple identical entries with the same timestamp suggest duplication.

2. Step 2: Understand common causes of duplicates

   Logging errors or software bugs often cause repeated entries, not multiple simultaneous logins.

3. Final Answer:

   Duplicate log entries due to logging error -> Option D

4. Quick Check:

   Repeated identical logs = duplicate error [OK]

Hint: Repeated identical lines usually mean logging error [OK]

Common Mistakes:

• Assuming user logged in many times at once
• Thinking system clock caused duplicates
• Confusing encryption with duplication

5. You have a log file with entries showing user actions and IP addresses. How can you use log forensics to detect a possible brute force attack?

hard

A. Look for many failed login attempts from the same IP in a short time

B. Check for successful logins only

C. Ignore repeated IP addresses

D. Focus only on logout events

Solution

1. Step 1: Understand brute force attack signs

   Brute force attacks involve many login attempts, usually failures, from one source.

2. Step 2: Analyze log entries for patterns

   Look for repeated failed login attempts from the same IP address within a short time window.

3. Final Answer:

   Look for many failed login attempts from the same IP in a short time -> Option A

4. Quick Check:

   Brute force = many failed logins from one IP [OK]

Hint: Many failed logins from one IP = possible brute force [OK]

Common Mistakes:

• Checking only successful logins
• Ignoring repeated IP addresses
• Focusing on logout events only