TryBench
Spotting Unauthorized Bulk Exports
Read multi-line server logs to isolate off-hours mass customer data downloads and data exfiltration.
Why this matters
Logs are long and boring, but they show theft in progress. Spotting one strange line among hundreds can stop a data leak.
Spot Unusual Big Downloads
A support agent may open 15 records an hour. One session pulling 48,500 rows at 03:14 UTC (04:14 AM in Lagos) is a big warning sign.
In real life: A support agent usually opens a few records an hour. One account pulling 48,500 rows in a single request at 3 AM is very unusual.
Look at Three Signals Together
Check three things: a risky route (like /export-all), a very large row count, and activity at odd hours.
In real life: A guard would notice a person carrying 48,500 boxes out of a locked room at 3 AM. The route, the amount, and the time are three clues, and together they are very strong.
Extract Clean Structured Signals
Pull only the suspicious line into clean JSON. Then a security tool can read it and raise an alert automatically.
In real life: A smoke alarm only needs to know "fire in room 4". A short JSON line with the account, the route, and the rows gives the alert system exactly that.
Your practice task
Inspect the three server log lines below. Have the AI filter out normal single-row traffic and return raw JSON only (no ``` marks) for the suspicious mass export using keys: actor_account, endpoint, and rows_exported.
How to do it
- Read the three log lines above.
- Look for the one with a huge row count at an odd hour.
- Ask the AI to ignore normal one-row lines.
- Ask for raw JSON with actor_account, endpoint, rows_exported. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: Log Exfiltration Extractor
First-line triage for data loss prevention (DLP) alerts.
Filter log events for off-hours spikes in returned rows (>1,000) on administrative endpoints. Emit raw JSON with actor, route, and row counts.
More lessons in this course
- Fake Invoice Scam: Spot Business Email CompromiseSpot typosquatted vendor domains, enforce out-of-band phone verification, and layer email security controls.
- Shadow-AI Governance & Secret LeaksEnforce approved workplace AI tools, classify data, sanitize configs, and rotate credentials if leaked.
- Ransomware First Steps: Isolate the ComputerExecute CISA-aligned ransomware containment: isolate network interfaces immediately and escalate to incident response.