Analyzing auth.log and Playing with Grok Filters - HTB Sherlocks - Brutus
Source: YouTube · IppSec · published Oct 19, 2024 · 1:05:38
This video demonstrates solving the "Brutus" Hack The Box machine by analyzing Unix log files, first via manual bash scripting and then using the Grok tool for JSON conversion.
Key Takeaways:
• The challenge focuses on parsing Unix log files to identify logged-in users and analyze system activity 1:30.
• The initial approach involves using bash commands to filter and process raw log data efficiently 4:15.
• The presenter transitions to using Grok to parse logs into JSON, a method preferred for professional log analysis 7:45.
• This technique mirrors real-world tasks for CIS admins handling large volumes of raw system logs 9:20.
By combining manual scripting with automated parsing tools, this exercise highlights effective strategies for forensic log analysis and system administration.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is ipag I'm doing Brutus from hack the box which is a very easy show lock that mainly focuses on the Unix log off. log it also lightly touches the WT file that's going to show you users that have logged into the box but I think there's going to be something for everyone in this video I'm essentially going to solve this Sherlock twice the first way we're going to go the easy way that most people did and just do a bunch of bash Fu on this log file in order to answer the questions and then after we got them all answered I'm going to take a step back and then go beyond root as we call it and use a tool called grock to parse this log convert it into Json and the reason why I want to use Gro is because that's generally how I analyze log files when I was a CIS admin w…