Hack the Route Start free Open app

Labs / Night Watch

Blue teamThe medal for finishing it

Road 8 of 11

Night Watch

Detecting an attack, hardening a host, and reading and responding to what happened.

3 groups · 7 labs · builds on Sealed Lines

Start this road, free

IDS/IPS, honeypots & sinkholes

Spotting attacks with decoys, sinkholes and signatures.

  1. 01 A honeypot: the host nobody should touch Set out a decoy nobody should touch, and catch a scan that does. Free
  2. 02 DNS sinkhole: blocking bad domains for every client at once Block a bad domain for every client at once and find the infected host. Pro
  3. 03 IDS and IPS: Suricata watching, then blocking Detect an attack with Suricata on a copy of traffic, then block it inline. Pro

Harden & audit: vulnerability scanning, baselines & file integrity

Scan a host, fix what is found and catch tampering.

  1. 01 Vulnerability management: scan, assess, remediate, rescan Scan a host against a baseline, fix the findings and catch a tampered file. Pro

Forensics, incident response & log correlation

Reading what happened and responding by the runbook.

  1. 01 Packet forensics: reading an incident from a capture file Pcap analysis of an incident: work out what happened from one saved capture. Pro
  2. 02 Log correlation: one event, many logs, a rule that joins them Join logs from several devices into alerts with rules, like a small SIEM. Pro
  3. 03 Incident response: working a live compromise by the runbook Find and clean up a live compromise step by step, following the runbook. Pro

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Start this lab, free