Correlate the intrusion
You have four logs that each caught part of the attack. Prove they are one incident, find when it started, and write the timeline down.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`grep -rl '203.0.113.66' /srv/soc-data` shows every source the actor touched.
The earliest attacker event is the `Accepted password` line in auth.log.
Solution explanation
You proved four logs were one incident by threading the attacker IP through all of them, then ordered the events from the 08:03:52 SSH login onward into a timeline naming the actor (203.0.113.66) and the first account to fall (svc-backup). Correlation plus a timeline is what separates "some alerts fired" from "here is what happened, in order."
Show solution
cd /home/student
grep -rl '203.0.113.66' /srv/soc-data 2>/dev/null
grep -F 'Accepted password' /srv/soc-data/linux/auth.log
printf '08:03:52 SSH login as svc-backup from 203.0.113.66\n08:10 web scan\n08:12 web shell upload\n08:20 Windows logon attack\n' > /home/student/timeline.txt