One actor, many logs

The same thread runs through everything

A real incident is scattered across sources: the SSH log, the web log, the Windows events and the sensor alerts each hold one fragment. Correlation is proving they are the same story. The thread here is the attacker IP — search for it across every text source:

grep -rl '203.0.113.66' /srv/soc-data 2>/dev/null

In the terminal

student@vulntech:~$ grep -rl '203.0.113.66' /srv/soc-data 2>/dev/null
/srv/soc-data/linux/auth.log
/srv/soc-data/nids/conn.log
/srv/soc-data/nids/eve.json
/srv/soc-data/web/access.log
/srv/soc-data/windows/security.log

The same IP in the auth log, the access log, the Windows export and the Suricata feed is strong evidence of one coordinated actor — not four unrelated events.

Tip: grep -r searches recursively; -l prints just the file names that match. It is the fastest way to ask "where does this indicator show up?"