Lesson 4 of 12 · Triage and logs
Analyzing logs: auth, journald, auditd and the web server
Objective
Turn thousands of log lines into precise answers: who logged in, with which account, from which address, when, and which commands ran — while spotting logs an attacker may have wiped.
This lesson is part of the full course
Unlock Linux Incident Response and Digital Forensics to read every lesson, do the exercises, access the simulations and earn your certificate.
Already enrolled? Log in.