Cybersecurity research starter

Original investigation outline

• Frame a question: Which indicators in a fictional security log distinguish a benign mistake from a suspicious sequence?
• Describe the evidence: timestamps, action types and events; do not treat an isolated event as proof of an attacker.
• Identify a pattern: distinguish failed logins, a successful login and an unexpected data export.
• Evaluate alternatives: record at least two explanations and the evidence for and against each.
• Propose proportionate defensive steps, such as notifying an administrator or reviewing permissions.
• Reflect: explain what additional lawful evidence would improve confidence.

Practical files and worked starter

Use the browser activity to explore the idea first, then download the corresponding CSV dataset and commented Python program to run locally.

Suggested research log