Security events analysis in SQL

The brief

A security analyst wants to hunt for threats with queries, not just alerts. Load network flow records into a database and write SQL that finds unusual activity: scanning, data exfiltration, rare ports and hosts talking to many others. Good looks like: a sensible table design, documented hunting queries, and findings checked against the dataset's labels.

What you will build

1. Load network flow records into a database
2. Design tables and indexes for hunting
3. Write queries for scans, rare ports and large transfers
4. Check findings against the attack labels
5. Document a hunting playbook

Free, open data to build it with

• UNSW-NB15 ↗ UNSW Canberra

Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.