Detection as Code with Grafana
By Richard Augenti
Define alert rules and dashboards as version-controlled code, test them against replayed attack telemetry, and ship them through a pipeline like any other artifact.
Free to browse. Takes about 60 minutes once you start.
Lab Overview
- Detection is only useful if it is written down - versioned, reviewed and tested like code, rather than a query someone types into a dashboard during an incident and then forgets.
- In this lab you ship the payments platform's authentication logs into Loki, write a LogQL query that detects a brute-force attack, and confirm it fires on the attack while staying quiet on ordinary traffic. A detection is judged on both halves of that sentence: what it catches, and what it correctly ignores.
- Loki is already running on your lab machine with the logs shipped in. Everything is local - no cluster and no external services.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH, with Loki running and the authentication logs already shipped in. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Checking your work: verify.sh machine-checks each objective, and setup.sh --force rebuilds the lab and its services if you want to start over.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.