This project examines suspicious login activity and employee machine data using SQL filtering techniques.
I worked with two datasets — employees and log_in_attempts — to investigate possible security incidents inside a large organization.
- SQL queries using AND, OR, NOT, and LIKE
- Filtering for specific dates and times
- Identifying suspicious login behavior
- Finding employees in specific departments or buildings
- Excluding certain conditions using NOT
sql-security-investigation.pdf - View Full PDF Report
This PDF contains my full write-up, explanations, and the SQL queries used in the investigation.
All SQL query screenshots from the lab environment are stored in the /screenshots folder.
- SQL filtering (AND, OR, NOT)
- Pattern matching with LIKE
- Time-based filtering
- Date range filtering
- Basic incident investigation logic
- Data validation & verification
In this investigation, I analyzed:
- Failed login attempts after business hours
- Login activity on specific suspicious dates
- Login attempts outside Mexico
- Employees in Marketing offices located in the East building
- Employees in Finance or Sales departments
- Employees in all departments except Information Technology
These tasks simulate common investigative steps a SOC analyst performs when reviewing suspicious activity.