OS Logs Lab
Collect auth log samples from $LAB Windows and Linux — export redacted notes only.
Visual · t16_os_logs_lab
Lab: OS log triage on $LAB. Original Cyberlium.
Your evidence pack is redacted log lines from your VM — not a dump from someone else's server.
On YOUR lab pair: Windows $LAB — filter Security for 4624/4625 after one success and one intentional failure. Linux $LAB — journalctl or auth.log lines for sshd success/failure you generated. Write a three-line triage summary (who, when, outcome). Save under $HOME/cyberlium-lab chmod 600. No remote log collection, no production exports, no posting raw logs publicly.
1. Windows sample
Export filtered Security view or screenshot with usernames redacted.
Note logon type and source if present — literacy for 4624.
Command guide
Try these commands — Windows sample
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: journalctl, python3. Reference sites: OS logs lab (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); Sigma rules (https://sigmahq.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Linux sample
Capture last 5 sshd lines you caused on $LAB — redact IP if not lab-only.
Note which file or journalctl command produced them.
3. Teardown
Secure notes chmod 600. Delete exports with secrets after review.
No log forwarding to public paste sites.
4. What you ship: OS logs lab pack
Redacted Windows + Linux log samples + triage summary.
5. What you record before the next lesson
OS logs lab notes path.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Pull auth.log from shared cloud VM you do not administer.
- Right: Lab samples from $LAB only. Next: quiz.
Mission: OS logs lab
1) One 4624 and one 4625 (or equivalent) on $LAB Windows. 2) Matching sshd lines on $LAB Linux. 3) Triage summary; chmod 600 notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum redaction before sharing screenshot?”
APPLY: OS logs lab target:
APPLY: True or False: Raw production logs belong in public repos.
APPLY: After lab: