Explore GREP & Pattern Matching

Every log file looks like noise until you know what you're isolating. Nugget starts you where security work actually starts: a raw auth.log full of failed logins, sudo calls, and timestamps, and the question of which three lines matter. You'll run grep against real text, not toy examples, and watch the difference between a match and a false lead show up on your own screen.

The traps here are specific and unglamorous — an unescaped dot in an IP pattern that quietly matches anything, a shell wildcard habit that breaks the moment you switch to regex, a caret that means negation in one spot and anchor in another. Nugget doesn't list these as warnings up front. It sets up a pattern that looks right, lets you run it, and asks why the output includes lines it shouldn't.

You'll build outward from a single literal match toward the pipelines analysts actually use: grep feeding awk for frequency counts, -C pulling context around a flagged event, an IOC regex tuned tight enough to avoid noise but loose enough to catch a defanged domain. None of it replaces a class on regex theory — it's the part that only shows up once you're staring at a terminal and the pattern isn't matching what you expected.