Module 4: Security, Logs & Monitoring¶
Days 16–20 · Intermediate → Advanced
You will investigate system and security logs, detect suspicious authentication patterns, audit and configure firewalls safely, run security baseline checks, and investigate unexpected network activity.
Module outcomes¶
- Query the systemd journal,
/var/logand Windows Event Logs efficiently. - Detect failed and suspicious logins with Linux auth logs and Windows Security event IDs.
- Review and change firewall rules safely, with backups and rollback.
- Audit privileges, permissions and Defender status, and follow an investigation workflow.
Lessons¶
| Day | Lesson | Lab | Status |
|---|---|---|---|
| 16 | System Logs | Lab 16 | 2026-11-14 22:00 IST |
| 17 | Authentication and Security Monitoring | Lab 17 | 2026-11-15 22:00 IST |
| 18 | Firewall Management | Lab 18 | 2026-11-15 22:00 IST |
| 19 | System Security Auditing | Lab 19 | 2026-11-16 22:00 IST |
| 20 | Network Security Investigation | Lab 20 | 2026-11-16 22:00 IST |
Module test: released with Day 20 in Assessments.