This was a packed module.
To summarize,
we have enriched log data with GeoIP information based on the public IP address.
Second,
we correlated the connection and HTTP request logs to detect beaconing activity.
Then,
we performed long‑tail and similarity analysis on DNS
traffic to identify suspicious websites.
To gain a different perspective on data,
we have built visualizations with Matplotlib to detect
anomalies attributed to ransomware infections.
In the next module,
we'll interact with other services and technologies to
build more complex log analysis workflows.