This project demonstrates end-to-end Incident Response handling performed by a SOC Analyst.
It covers incident detection, investigation, documentation, and response playbook creation using real Linux security logs.
The goal of this project is to simulate real-world SOC operations and showcase practical cybersecurity skills required for an Entry-Level SOC Analyst role.
- Detect a security incident from system logs
- Investigate Indicators of Compromise (IOCs)
- Perform log-based threat analysis
- Document findings in a professional Incident Report
- Create a reusable SOC Playbook for future incidents
- Operating System: Ubuntu Linux
- Logs Analyzed:
/var/log/auth.log - Services: OpenSSH
- Commands: grep, awk, sort, uniq
- Documentation: Markdown (.md)
- Version Control: GitHub
- Incident Type: SSH Brute-Force Attack
- Severity Level: Medium
- Attack Source: External IP Address
- Attack Pattern: Multiple failed SSH login attempts
- Enabled and monitored SSH service
- Simulated brute-force login attempts
- Verified log generation in auth logs
- Extracted failed login events
- Identified malicious IP addresses
- Counted repeated attack attempts
- Assessed impact and confirmed no successful compromise
sudo grep "Failed password" /var/log/auth.log
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}'
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr