🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Scripting for Cybersecurity › Lesson 12
TEC-CYBE44-05 · Lesson 12 · 22 clock hours · practice

Capstone Script Project: Automated Security Monitoring Tool

Objective. Students design, build, test, document, and present an integrated Python or Bash security-monitoring tool that combines at least four skills from the course into a single working program.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Capstone Script Project: Automated Security Monitoring Tool

This lesson brings together everything you have practiced in Scripting for Cybersecurity. You will design, build, test, document, and present a single working Python or Bash program that combines at least four skills from the course. The project mirrors real-world security engineering: professionals are regularly asked to automate repetitive monitoring tasks, and the ability to deliver a complete, documented tool is what separates a practitioner from someone who only knows isolated commands.

Why Automation Matters in Security

Manual log review, repeated port scans, and hand-checked file hashes do not scale. A security analyst protecting even a modest network may need to inspect thousands of events per day. Scripting converts those repetitive tasks into reliable, repeatable processes. Employers who hire for roles aligned with CompTIA Security+, CySA+, and ISC2 CC all expect candidates to demonstrate some scripting fluency. Your capstone tool is evidence you can do this.

Phase 1 — Design

Before writing a single line of code, submit a one-page project proposal. A good proposal answers four questions:

1. Purpose — What threat or monitoring gap does your tool address? Examples include detecting failed SSH login bursts, alerting on new listening ports, or flagging files whose hashes have changed since a known-good baseline.

2. Skills integrated — Name at least four course skills explicitly (for example: file I/O, regular expressions, subprocess calls, network socket inspection, log parsing, hash computation, or scheduled execution).

3. Inputs and outputs — What data does the tool read (log file path, IP range, baseline file)? What does it produce (console alert, report file, exit code)?

4. Repository structure — Sketch the folder layout: `main.py` or `monitor.sh`, a `tests/` directory, a `data/` directory for sample inputs, and a `README.md` at the root.

Your instructor must approve the proposal before you begin coding. If a revision is requested, treat the feedback as a professional code-review comment — address it specifically and resubmit promptly.

Phase 2 — Build and Test

Work incrementally. Make a Git commit every time you complete one functional milestone, not just at the end. Meaningful commit messages such as `Add log-parser function for auth.log` tell a future reader (including your instructor and future employer) exactly what changed and why. Avoid messages like `update` or `fix stuff`.

Run your tool against the lab data provided in course lab guide chapter 12. When the tool produces incorrect or missing output, use a systematic debugging process: add print or logging statements, narrow the failing section, fix, and re-test. Record all bugs you found and how you resolved them — this information strengthens your README and your defense presentation.

Your README must include: a one-paragraph description, prerequisites (Python version or Bash version, required libraries), installation steps, and at least two usage examples with sample output. A README that lets a stranger run your tool without asking you questions is a professional-quality README.

Record a short screen-capture demo using OBS or equivalent software showing the tool running against sample data and producing correct output. This recording protects you if a live demo has a technical problem during your defense.

Phase 3 — Defense

Each student presents for 8–10 minutes. Structure your presentation in three parts:

Answer honestly. If you do not know something, say so and explain what you would do to find out. That is professional behavior.

Safety and Security Considerations

Even in a lab environment, scripting carries real risks. Always run your tool against the provided lab data only — never point network scanners or log parsers at systems you do not own or have explicit permission to test. Handle any credentials (API keys, passwords) through environment variables, not hard-coded strings in your source code. Before committing, check that no sensitive data is included in your repository. These habits are not just good practice; they reflect the ethical obligations outlined by ISC2 and the professional standards referenced in CompTIA certifications.

On the physical side, you are working on Ubuntu VMs on shared lab hardware. Follow your lab's standard procedures for session management: lock your screen when stepping away, log out when finished, and do not save credentials to the VM desktop.

Rubric Summary

All four criteria must be met to pass:

1. The tool runs without errors on the instructor's test data.

2. At least four course skills are visibly integrated.

3. The Git repository has meaningful commits and a complete README.

4. The student answers three instructor questions about the code during the defense.

Review the full rubric provided at project start before you begin your proposal so you know exactly what is evaluated at each phase.

Key terms8

Incremental developmentA coding practice in which a program is built and tested one small functional piece at a time rather than all at once, reducing the cost of finding and fixing bugs.
Git commitA saved snapshot of changes to files in a Git repository, accompanied by a message that describes what changed and why; commits create a traceable history of development.
READMEA plain-text or Markdown file placed at the root of a software repository that describes the project's purpose, prerequisites, installation steps, and usage examples.
Security monitoringThe continuous collection and analysis of system, network, or application data to detect anomalies, policy violations, or indicators of compromise in near real time.
Hardcoded credentialA password, API key, or other secret embedded directly in source code rather than supplied through an environment variable or secrets manager; a significant security risk because the secret is exposed to anyone who reads the code.
Environment variableA named value stored in the operating system's process environment and read by a running program; used to pass configuration and secrets to scripts without embedding them in source code.
Subprocess callA method by which a running script launches an external program or shell command and optionally captures its output; in Python this is typically done with the subprocess module.
Defense presentationA structured demonstration in which a student walks an evaluator through their project code, shows live output, and answers technical questions to prove they understand what they built.
In class: Design phase (first session): students submit a one-page project proposal specifying the tool's purpose, the four or more course skills it integrates, required inputs and outputs, and a Git repository structure plan — instructor approves or requests revision before coding begins. · Build and test phase (second and third sessions): students write the tool incrementally with Git commits at each functional milestone, run the tool against provided lab data, fix bugs, write a README with usage instructions, and record a short screen-capture demo of the tool running successfully. · Defense phase (final session): each student presents their tool to the class for 8–10 minutes — walking through the code, demonstrating live output, and answering instructor questions about design decisions, security considerations, and one improvement they would make given more time.
Materials: Ubuntu VM, all course lab tools and libraries, Git, VS Code, screen-recording software (OBS or equivalent), course lab guide chapter 12, rubric provided to students at project start
Check: Tool meets all rubric criteria: runs without errors on instructor's test data, integrates at least four course skills, repository has meaningful commits and a complete README, and student can answer three instructor questions about the code during the defense; all criteria must be met to pass.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Security+ — Threats, Vulnerabilities, and Mitigations
1. A student hard-codes an API key directly into their monitoring script and commits it to a public GitHub repository. What is the most immediate security risk?
CySA+ — Security Operations
2. Which Git commit message best follows professional best practices for an incremental build?
Security+ — General Security Concepts
3. During a capstone defense, the instructor asks: 'What could an attacker do if this script ran as root?' This question primarily tests the student's understanding of which concept?
CySA+ — Security Operations
4. A student's automated log-monitoring tool must alert when more than five failed SSH login attempts occur from the same IP address within one minute. Which course skill is the student most likely using to extract IP addresses from the log lines?
CySA+ — Security Operations
5. A student wants her script to run an external command and capture its text output for further processing in Python. Which approach is most appropriate?
ISC2 CC — Security Principles
6. According to the capstone rubric, what happens if a student's tool integrates five course skills and has a complete README, but crashes on the instructor's test data?
CySA+ — Security Operations
7. A student is preparing the README for her capstone tool. Which content is most important to include so that someone unfamiliar with the project can use it without asking questions?
CySA+ — Vulnerability Management
8. During the build phase, a student discovers her script produces no alert when a suspicious log entry is present. Which is the most systematic first debugging step?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram plan