Detecting and Responding · Lesson 9 of 11
Reading logs like an analyst
The system keeps a diary
Every serious system keeps logs: records of who did what and when. Logs are how an analyst spots an attack, often the only trace it leaves.
A login log might look like this. Run the code to count the failed attempts:
Python
Three failed logins for "admin" in a row is a warning sign: someone may be guessing the password. An analyst watches for exactly these patterns: many failures, odd hours, or logins from far away.
Exercise
Exercise — check your understanding
Given the list logins, count how many entries are failures (they start with "FAIL") and store the number in fail_count.
You’re reading for free. Sign in to keep your progress and earn a certificate when you finish.Sign in to keep my progress →