Tune the detection
You are handed /home/student/logins.log: one real brute force mixed with two benign users who just mistyped their passwords. Build a detection that catches the attack without flagging the benign activity, using a threshold of 10 or more failed logins from a single source IP.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Count per IP: `... | sort | uniq -c`, then keep counts `>=10`.
alice's pattern (a few fails then a success, internal IP) is the classic false positive.
Solution explanation
Your tuned rule flagged one source — the real brute force at 203.0.113.66 — while alice's two typos and bob's single miss stayed quiet under the 10-failure threshold. That is detection engineering in a nutshell: write the rule from the attack, then raise the bar just enough to silence the benign noise without blinding yourself to the real thing.
Show solution
cd /home/student
grep 'Failed password' /home/student/logins.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -rn
grep 'Failed password' /home/student/logins.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | awk '$1>=10{n++} END{print n+0}'
echo "grep 'Failed password' logins.log | grep -oE '([0-9]{1,3}[.]){3}[0-9]{1,3}' | sort | uniq -c | awk '\$1>=10'" > /home/student/detection.sh