# Local synthetic fixture · illustrative script replay
analyst@local:~/security-lab$ pwd
/home/analyst/security-lab
analyst@local:~/security-lab$ find fixtures scripts -maxdepth 1 -type f -print
fixtures/auth-events.jsonl
fixtures/README.md
scripts/auth-triage.sh
analyst@local:~/security-lab$ sed -n '1,20p' scripts/auth-triage.sh
#!/usr/bin/env bash
set -euo pipefail
events="${1:-fixtures/auth-events.jsonl}"
test -r "$events" || { printf 'fixture unavailable\n' >&2; exit 1; }
jq -r 'select(.event == "login_failed") | .src_ip' "$events" \
  | sort | uniq -c | sort -nr
analyst@local:~/security-lab$ ./scripts/auth-triage.sh fixtures/auth-events.jsonl
  14 192.0.2.18
   3 198.51.100.7
analyst@local:~/security-lab$ jq -r '.event' fixtures/auth-events.jsonl | sort | uniq -c
  17 login_failed
   6 login_success
analyst@local:~/security-lab$ python3 - <<'PY'
import json
from collections import Counter
from pathlib import Path
rows = map(json.loads, Path("fixtures/auth-events.jsonl").read_text().splitlines())
counts = Counter(row["src_ip"] for row in rows if row.get("event") == "login_failed")
print({ip: n for ip, n in counts.items() if n >= 5})
PY
{'192.0.2.18': 14}
analyst@local:~/security-lab$ printf '%s\n' 'Review source events before escalating.'
Review source events before escalating.
analyst@local:~/security-lab$ cat fixtures/README.md
Synthetic authentication events for a local training exercise.
Documentation addresses only: 192.0.2.0/24 and 198.51.100.0/24.
No production identities or systems are represented.
analyst@local:~/security-lab$ printf '%s\n' 'Threshold reached; verify context and scope.'
Threshold reached; verify context and scope.