STARTER MISSION / CYBERSECURITY
Analyze synthetic authentication logs
Practice a defensive investigation using fictional login events. Explain the pattern, test your detection idea and write a short incident-triage report.
The build brief
Work through the requirements in order. Keep your test notes as you go.
- 01
Set the safe scope
Use only synthetic records or a lab you own and have permission to test. Define the system, time window and what the exercise excludes.
- 02
Explain the detection idea
State what pattern you want to find and why it may matter. Do not treat a failed login alone as proof of an attack.
- 03
Test against counterexamples
Include normal mistakes, missing fields and repeated failures. Record which cases are flagged and where the rule is weak.
- 04
Write the short report
Separate observations, possible explanations and recommended checks. Include risk, remediation, limitations and a reproducible method.
Minimum evidence checklist
These are self-checks. A checked box does not independently verify the work.
- The lab/data scope is authorized and contains no real credentials or personal identifiers.
- The event fields, time window and data-generation method are described.
- The detection rule is explicit and can be reproduced.
- Expected results include normal, suspicious and incomplete-data cases.
- The report separates facts, hypotheses and business risk.
- Limitations, false positives and practical next checks are documented.
An honest project summary
A worked writing example, not a completed reference build.
I wrote a rule for repeated failures followed by a success in a fictional dataset. I tested a normal forgotten-password case and a missing-timestamp case. The rule flags a pattern for review; it does not prove account compromise.
Before you call it done
A useful handoff makes the gaps visible.
- 01
Attach real artifacts
Use your actual repository, test notes, dated screenshots or a setup explanation. Do not invent a result to fill a missing field.
- 02
Explain your contribution
Credit a tutorial, template, dataset or teammate. State what you changed and why.
- 03
Mark what remains unknown
Describe tests you did not run and evidence you cannot safely share. Respect source licenses and agreements.