Tools of the Trade: Apply filters to SQL queries

As part of the Google Cybersecurity Professional Certificate on Coursera, I completed the SQL section of the “Tools of the Trade: Linux and SQL” course. This module focused on using SQL to support cybersecurity operations—specifically for querying security logs, analysing suspicious patterns, and extracting actionable insights from structured datasets. An organisation is working to make their system more secure. It is my job to ensure the system is safe, investigate all potential security issues, and update employee computers as needed. The following steps provide examples of how I used SQL with filters to perform security-related tasks.
🛠️ Responsibilities

There was a potential security incident that occurred after business hours (after 18:00). All after-hours login attempts that failed need to be investigated.
The following code demonstrates how I created a SQL query to filter for failed login attempts that occurred after business hours.
A suspicious event occurred on 2022-05-09. Any login activity that happened on 2022-05-09 or on the day before needs to be investigated.
The following code demonstrates how I created a SQL query to filter for login attempts that occurred on specific dates.
After investigating the organisation's data on login attempts, I believe there is an issue with the login attempts that occurred outside of Mexico. These login attempts should be investigated.
The following code demonstrates how I created a SQL query to filter for login attempts that occurred outside of Mexico.

🛠️Skills Gained

Writing and Optimizing SQL Queries 🞄 Data Filtering and Aggregation 🞄 Log and Event Data Analysis 🞄 Cybersecurity Use Cases for SQL 🞄 Analytical Thinking and Pattern Recognition

🛠️Reflection

This module helped me build a strong foundation in SQL as a critical tool for modern cybersecurity analysis. By practicing how to query and interpret log data, I gained the ability to support threat detection, investigate incidents, and report findings in a structured and meaningful way—skills essential to any SOC or cybersecurity operations role.