Whenever you're ready, walk me through how you'd approach this.
Given a raw log file, what specific commands would you use to isolate suspicious activity?
Assume the file is a large, line-oriented Linux log with timestamps, source addresses, usernames, event types, and free-text messages. Explain the commands you would use to identify authentication failures, unusual source addresses, suspicious commands, and activity clustered in a time window. Include how you would avoid losing context or treating a simple text match as proof of compromise. Keep the answer focused on standard shell utilities and commands.