The lab print is list order | Rapid course Security operations and blue team

Lesson map

Lesson 05. Map, example, EX051.

flowchart TD
  L["Six tuples, written order"] --> P["One pass, no sort"]
  P --> O["Six lines in that same order"]
  O --> Q{"Did severity pick the first line?"}
  Q -->|No| K["Keep the embedded print"]

The loop follows the list. It does not rank the rows.

Logical drawing

e.finch   Fri 08:52 UK ok
e.finch   Fri 13:05 UK ok
e.finch   Fri 23:47 BR CHECK: new country, night
s.marlow  Fri 09:10 UK ok
l.barros  Fri 08:30 UK ok
e.finch   Sat 00:02 BR CHECK: new country, night

Learning outcomes

After this chapter, you should be able to:

Name the list the sign-in script walks.
Separate that written order from a severity ranking.
Refuse a note that reorders or drops a line.

5.1 One pass, and the format width is not a ranking.

lab_signins.py stores six tuples. Each tuple is a user label, a day-and-time token, and a country token. Each pass takes the next sign-in tuple from signins and does not reorder the six. Nothing in the file calls sort, sorted, or min.

The print format starts with {user:9}. Width 9 pads a short label with spaces on the right. e.finch is seven characters, so two pad spaces sit inside the field, and the format then adds one more space before the time token. s.marlow and l.barros are eight characters, so each keeps one pad space inside the field. Those spaces do not encode severity. Elaine's Friday 08:52 line is first because that tuple is first, even though a reader might want the Brazil lines moved to the top. The Saturday 00:02 line is last because that tuple is last, and it still prints.

A later decision to investigate Elaine's mailbox is a sentence in the incident log. It does not delete a tuple. A print that started with the 23:47 line would be a different list.

Lesson table; scroll horizontally to read all columns →

What the loop uses	What it does not use
Position in `signins`	A severity score
The three fields of that tuple	A mailbox search
Format width 9	A second ordering key

5.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered result	What produced it	Decision
Six lines, Friday 08:52 first	List order, one pass	Keep
Both Brazil lines still present	Their tuples were not deleted	Keep
"The script sorted by country."	No sort is called	Refuse
"The ok lines were dropped."	Four tuples still print `ok`	Refuse

Synthetic case. These six tuples are the only sign-in output.

Errors and limits

Do not rebuild the list so that it matches a later investigation.

Apply

EX051 — List order. The print names Friday 08:52, Friday 13:05, Friday 23:47, then s.marlow, l.barros, and Saturday 00:02. May a severity ranking, or a later decision to investigate one mailbox, replace that order?
Show marking criteria
Rubric: 3 = no; the six tuples stay in written order; width 9 is padding; do not sort the script;; 2 = the six lines stay and the later decision stays prose;; 1 = one line;; 0 = none.