A security analyst is examining raw log snippets collected by a SIEM system from various network resources. Match each log entry pattern on the left to the corresponding security event or attack type on the right.
- 192.168.1.105 - - [27/Jul/2026:14:22:10 +0000] "GET /login.php?user=admin' OR '1'='1" 200 452SQL Injection (SQLi)
- Jul 27 14:23:01 authserver sshd[4921]: Failed password for root from 10.0.0.45 port 52112 ssh2 (repeated 500 times in 1 minute)SSH Brute Force Attack
- 192.168.1.50 - - [27/Jul/2026:14:25:30 +0000] "GET /profile.php?name=<script>alert('cookie')</script>" 200 1200Cross-Site Scripting (XSS)
- Jul 27 14:26:05 firewall filterlog: drop in on em0 proto TCP from 192.168.1.200 to 10.0.0.15 across destination ports 1 through 1024Port Scan / Reconnaissance
Answer
The HTTP GET request with SQL syntax matches SQL Injection; the repeated SSH authentication failures match SSH Brute Force; the script tag payload matches Cross-Site Scripting; and the sequential port connections match Port Scan / Reconnaissance.
Each log snippet exhibits explicit operational indicators: SQL control characters indicate SQL Injection, high-frequency authentication failures indicate SSH Brute Force, client-side script tags indicate XSS, and sequential port sweep drops indicate a network Port Scan.
Step-by-Step Solution
Key Concept
Log Pattern Analysis and Threat Identification
Estimated Time:1m 0s