Linux16: Top Offenders

After spotting the shape of the data, you need to summarize it — specifically, which source shows up the most

Objective

Learner can extract a specific column from delimited data, sort it, and count occurrences

Mission

From the log at ~/cases/case-1042/evidence/access-events.log, Sarah now wants a summary: which source IP appears most frequently in the log — the likely brute-force origin. Copy the report template at ~/documents/access-summary-template.txt to a new file named ~/documents/access-summary.txt, then fill in the Most frequent source IP field in that new file

Commands you may need to solve this lab

cutsortuniq -c

Questions

1. Which command extracts a specific field from delimited data?

2. Why must data be sorted before counting occurrences with uniq?

3. Which uniq option counts occurrences of each unique line?

Machine Offline

Isolated container is offline

Click "Start Machine" to boot your sandbox instance and choose your preferred interface