Security log analytics
You analyse authentication, endpoint, network, DNS, proxy and web records with Pandas and SQL, and find traces of brute force, impossible travel, lateral movement and exfiltration.
Level 301 · 18 lessons · 18 practice labs
Lessons
Identity
- The structure of authentication records
- Brute force and password spraying
- Impossible travel
- Privileged account activity
- Quick task: find a password-spraying campaign
Endpoint
- Process creation events and parent–child links
- Rare processes and long-tail analysis
- Persistence traces: services, tasks, start-up items
- Quick task: a shell spawned by an office app
Network
- Flow records: who talked to whom and how much
- DNS analytics: long, random and rare names
- Proxy and web logs: user agents and status codes
- Exfiltration: volume and destination analysis
- Quick task: find a DNS tunnel
Bringing it together
- Correlating across sources
- Reconstructing lateral movement from logs
- Building an incident timeline
- Capstone: trace a compromised account end to end
Practice labs
- Brute force or a forgetful user: Use failed-login counts and timing to tell which account is under attack and which just forgot a password.
- Impossible travel: Find impossible-travel cases from the time and distance between one account's logins from two far-apart countries and screen out those caused by VPNs.
- Unusual use of a privileged account: Build an admin account's usual profile of hours, sources and targets and list the sessions that fall outside it with reasons.
- Parent-child process pairs: Count the most and least common parent-child pairs in process-creation events and examine the rare ones.
- Rare processes through long-tail analysis: Find the executables seen on only one or two machines out of a thousand and prioritise them by path and signature information.
- Gather persistence traces: Combine new-service, scheduled-task and start-up-item events and find the machine that left more than one persistence trace on the same night.
- Who talked to whom and how much: Extract the ten internal-external pairs exchanging the most data from flow records and write their volumes in MB.
- Random-looking domain names: Compute length and entropy for DNS queries and find the clients querying names that look algorithmically generated.
- Slow, low-volume exfiltration: Find, with cumulative volume analysis, the host that stays under the daily threshold but uploads steadily to the same destination for weeks.
- Rare user agents: Find the user agents used by only one client in a proxy log and flag signs of scripts and tools.
- Scanning from status-code patterns: Find clients producing many 404s and 403s in a short time and separate directory scanners from ordinary browsing.
- First contacts with new domains: Find the first connections to domains never seen before in the organisation and rank the suspicious ones by volume and repeat pattern.
- Link two sources by user: Match VPN sessions to file-server accesses on user and time and produce the files accessed per session.
- Rebuild a lateral-movement chain: Build the source-target chain from remote-logon events and order the path from the first compromised machine to the final target.
- An incident timeline from three sources: Merge authentication, process and network logs into one timeline and write the incident's five stages with evidence lines to timeline.md.
- Bulk sending in mail logs: Find accounts sending to many external recipients in a short time in mail-tracking logs and rank them by send count.
- A suspicious mailbox rule: Find new mailbox rules in audit logs that forward messages to an outside address or move them to a hidden folder and identify the session that created them.
- Privilege escalation in cloud audit logs: Find the sequence in cloud audit logs where an account grants itself an admin role and then creates a new access key.
About this course
You analyse authentication, endpoint, network, DNS, proxy and web records with Pandas and SQL, and find traces of brute force, impossible travel, lateral movement and exfiltration.
What you will learn
- Identity
- Endpoint
- Network
- Bringing it together
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.