Cybersecurity · hands-on lab
SOC Lab 01: A Custom Log-Based IDS
Parse an authentication log in Python and raise an alert for every failed login — the core of any detection.
- 35 minutesTime in the lab
- beginnerLevel
- 3 tasksChecked automatically
- CertificateVerifiable link when you finish
The situation
Scenario. You are the new SOC analyst. Before buying a SIEM, the team wants a simple detector that reads the server's auth log and lists every failed login. You build it in Python.
What you will do
- Find the failed logins
- Write the alerts to a file
- What is a true positive?question
How it works
The lab opens in your browser: a real terminal or desktop, nothing to install. Work through the tasks, press Check after each one and the portal verifies your work. Stuck? Ask for a hint. Finish every task and you get a certificate page with its own verification link for LinkedIn or your CV.