Log Lines
Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 3 of 43.
A log is a record of things that happened, such as someone signing in or changing an account. Each entry includes the time. To find entries from a particular IP address, run:
seclab logs --ip 198.51.100.23You should see:
2026-10-19 17:02:41 shop-web LOGIN_OK user=lee ip=198.51.100.23This entry tells us that Lee signed in to shop-web at 17:02:41, using the address 198.51.100.23. LOGIN_OK means the sign-in succeeded. If the attempt had failed, the event would be LOGIN_FAILED.
When a ticket asks you to record what you found, use the answer command. Give your answer a name, then write the answer itself:
seclab answer address 198.51.100.23You should see:
Recorded your answer to address.Here, address is the name of the answer you are recording, and 198.51.100.23 is its value. For a ticket asking for an account, you would use account followed by the username.
Challenge
EasyTicket from Sam, IT lead
Your block ended a session from the attacker's address: they were already inside someone's mail. Find the sign-in that let them in, and record the account and the time it happened.
Try it yourself