Cybersecurity · hands-on lab

SOC Lab 02: SSH Brute-Force Detection

Count failed SSH logins per source IP and alert when one crosses a threshold — the classic SIEM detection.

Create an account to start Use or ask for a voucher

40 minutesTime in the lab
beginnerLevel
3 tasksChecked automatically
CertificateVerifiable link when you finish

The situation

Scenario. The auth log is noisy. Leadership wants a real detection: which source IP is hammering SSH? You count failures per IP and alert on any above a threshold.

What you will do

Count failures per IP
Alert above the threshold
Why threshold on source IP?question

How it works

The lab opens in your browser: a real terminal or desktop, nothing to install. Work through the tasks, press Check after each one and the portal verifies your work. Stuck? Ask for a hint. Finish every task and you get a certificate page with its own verification link for LinkedIn or your CV.