SQL Security Investigation Using Filters

Project Overview

This project demonstrates how SQL can be used to investigate security events and identify employee systems requiring security updates. Using SQL filtering techniques, I analyzed login activity and employee records to support security investigations.

Skills Demonstrated

• SQL
• Security Log Analysis
• Data Filtering
• Incident Investigation
• Cybersecurity Fundamentals
• Database Querying

Scenario 1: Failed Login Attempts After Business Hours

Objective

Investigate failed login attempts that occurred after 18:00.

Query

SELECT *
FROM log_in_attempts
WHERE login_time > '18:00'
AND success = FALSE;

Screenshot

Scenario 2: Login Attempts on Suspicious Dates

Objective

Investigate login attempts that occurred on the dates associated with a suspicious event.

Query

SELECT *
FROM log_in_attempts
WHERE login_date = '2022-05-09'
OR login_date = '2022-05-08';

Screenshot

Scenario 3: Login Attempts Outside Mexico

Objective

Identify login attempts originating from countries outside of Mexico for further investigation.

Query

SELECT *
FROM log_in_attempts
WHERE NOT country LIKE 'MEX%';

Screenshot

Scenario 4: Marketing Department Employees

Objective

Identify employees in the Marketing department located in the East building whose systems require updates.

Query

SELECT *
FROM employees
WHERE department = 'Marketing'
AND office LIKE 'East%';

Screenshot

Scenario 5: Finance and Sales Employees

Objective

Locate employees in the Finance and Sales departments whose devices require a security update.

Query

SELECT *
FROM employees
WHERE department = 'Finance'
OR department = 'Sales';

Screenshot

Scenario 6: Employees Not in IT

Objective

Identify employees outside the Information Technology department whose systems require a security update.

Query

SELECT *
FROM employees
WHERE NOT department = 'Information Technology';

Screenshot

Key Takeaways

This project demonstrates how SQL can be used to support cybersecurity investigations by filtering and analyzing login activity and employee records.

Through these exercises, I practiced:

• Using WHERE clauses
• Applying AND, OR, and NOT operators
• Filtering patterns with LIKE
• Investigating suspicious login activity
• Identifying systems requiring security updates