Intermediate · Logs, SIEM and incident response · topic 20 of 43 · 40 min
Logs and log sources
Explanation
Why logs are the analyst's evidence
When something goes wrong, the first question is "what happened, when, and who did it?". Logs answer that. A log entry (or event) records one thing that happened, with a timestamp. Without logs, an investigation is guesswork; with good logs, you can rebuild an attacker's every step.
The main log sources
| Source | What it tells you | Example |
|---|---|---|
| Windows Security log | Logons, failures, account and group changes | Event 4625: failed logon for "admin" |
| Linux auth logs | SSH logins, sudo use | /var/log/auth.log: Failed password for root |
| Firewall | Allowed and blocked connections | DENY TCP 198.51.100.23 → 10.0.0.5:3389 |
| Web server / proxy | Who visited which URL, status codes | POST /login 401 |
| DNS | Which names each device looked up | laptop-22 asked for update-check.example |
| EDR / antivirus | Malware detections, suspicious processes | Blocked: invoice.pdf.exe |
| Cloud audit logs | Admin actions in cloud accounts | AWS CloudTrail: DeleteBucket by user dev1 |
| Email gateway | Mail received, blocked, links clicked | Quarantined: "KYC update" from look-alike domain |
Linux authentication logs
Mar 14 02:11:42 web01 sshd[2231]: Failed password for invalid user admin from 198.51.100.23 port 51514 ssh2
Mar 14 02:11:45 web01 sshd[2233]: Failed password for root from 198.51.100.23 port 51522 ssh2
Mar 14 09:02:10 web01 sshd[3120]: Accepted publickey for asha from 10.20.5.7 port 50122 ssh2
Mar 14 09:05:33 web01 sudo: asha : TTY=pts/0 ; PWD=/home/asha ; USER=root ; COMMAND=/usr/bin/apt upgradeWindows Security Event IDs
Windows events are identified by number. These are the ones you will use most as a SOC analyst:
| Event ID | Meaning | Why you care |
|---|---|---|
| 4624 | Successful logon | Who logged in, from where, and how (logon type) |
| 4625 | Failed logon | Many in a row = password guessing |
| 4634 / 4647 | Logoff | Session length |
| 4648 | Logon with explicit credentials (for example "Run as") | Can show someone using another account |
| 4672 | Special privileges assigned to a new logon | An admin-level logon |
| 4688 | New process created (needs process auditing) | What programs ran |
| 4720 | User account created | Attackers create backdoor accounts |
| 4728 / 4732 | Member added to a security-enabled global / local group | Someone made an account admin |
| 4740 | Account locked out | Guessing or a user with an old saved password |
| 4768 / 4769 / 4776 | Kerberos ticket requests / NTLM credential validation (on domain controllers) | Domain authentication activity |
| 1102 | Audit log cleared | Almost always worth investigating |
Events 4624 and 4625 include a logon type, which tells you how the logon happened:
| Logon type | Meaning |
|---|---|
| 2 | Interactive: at the keyboard |
| 3 | Network: for example opening a shared folder |
| 4 | Batch: a scheduled task |
| 5 | Service: a service starting |
| 7 | Unlock: unlocking the screen |
| 10 | RemoteInteractive: Remote Desktop (RDP) |
| 11 | CachedInteractive: logon with cached domain credentials, for example a laptop away from the office |
Failed logons (4625) also carry status codes. For example, Sub Status 0xC000006A means the password was wrong, 0xC0000064 means the user name does not exist, and 0xC0000234 means the account is locked. Many failures with "user does not exist" usually mean someone is guessing names.
Microsoft Sysmon, a free tool, adds richer events: Event ID 1 (process created, with its command line and hash), 3 (network connection), 11 (file created) and 22 (DNS query). Many SOCs install it on important machines.
Time is everything
- Sync every device to a trusted time source with NTP. Logs with wrong clocks make timelines impossible.
- Know the time zone. Many systems log in UTC; Indian staff think in IST (UTC+5:30). Write timelines in one zone and say which.
- Keep logs long enough. In India, CERT-In's 2022 directions require organisations to keep ICT system logs for 180 days, stored within India (Module 8 covers this).
Getting logs to one place
Logs on a hacked machine can be deleted by the attacker. So logs are forwarded to a central place: on Linux using syslog (rsyslog), on Windows using Windows Event Forwarding or an agent, and from there into a SIEM (next lesson).
Common mistakes
- Logging is off. By default, Windows does not record every useful event (for example 4688 needs process auditing turned on). Check audit policies before an incident, not after.
- Collecting everything and reading nothing. Decide which events matter.
- Ignoring time zones and clock drift.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Logs and log sources · 1/8
Logs are time-stamped records of what happened. They are the analyst's evidence.
Prefer a video by a teacher? Find free videos on “windows event id 4624 4625 logon types explained SOC analyst” on YouTube ↗
In real life: Reading 4625 at 2 am
A SOC analyst for a Pune manufacturing firm sees 300 Event ID 4625 entries on a file server between 02:00 and 02:20 IST, logon type 3, all from one internal IP, for 120 different user names, most with Sub Status 0xC0000064 (user does not exist). That pattern is password spraying from inside the network, which means one internal machine is probably compromised. The analyst raises the priority and starts the incident process.
Practice (0/3 done)
A 4624 event shows logon type 10. How did the user log on?
Write failed_by_ip(lines) that reads Linux auth log lines and returns a dict of IP address → number of "Failed password" lines from that IP. Lines can say "Failed password for root from IP" or "Failed password for invalid user admin from IP". Ignore all other lines. Use the re module.
Write logon_type_name(code) that returns the meaning of a Windows logon type number: 2 "Interactive", 3 "Network", 4 "Batch", 5 "Service", 7 "Unlock", 10 "RemoteInteractive", 11 "CachedInteractive". Return "Other" for anything else.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- SIEM and alert triageLogs, SIEM and incident response · same module
- The incident response lifecycle (NIST SP 800-61)Logs, SIEM and incident response · same module
- A SOC analyst's day and playbooksLogs, SIEM and incident response · same module
- Logging and monitoring in the cloudCloud security basics
- Logging: structured, safe and centralisedDevOps: Git, Docker, Kubernetes and CI/CD · Monitoring and logging
- Linux security basicsSystems and cryptography
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Which Event ID is a failed logon?
Answer: 4625
4625: an account failed to log on.
Event 4720 means…
Answer: A user account was created
4720 records a new user account, a common attacker persistence step.
Why must all devices sync time with NTP?
Answer: So log timestamps line up and timelines are accurate
Mismatched clocks make it impossible to order events correctly.
Which Sysmon Event ID records process creation?
Answer: 1
Sysmon Event ID 1 is process creation, with command line and hashes.
Why forward logs to a central server?
Answer: An attacker on a machine can delete its local logs
Central copies survive even if a host is wiped.
Many 4625 events with Sub Status 0xC0000064 suggest…
Answer: Attempts with user names that do not exist (name guessing)
0xC0000064 means the user name does not exist.
Which Event ID shows that the Security log was cleared?Related
Which event most strongly suggests an attacker is hiding?Related
Answer: StopLogging
Turning off audit logging is a classic defence evasion step.
Ransomware is actively encrypting files on a server. Severity?Related
Answer: Critical
Active damage to important systems is critical: act immediately.
Which protects a domain's DNS records from being changed by someone who stole the registrar login?Related
Answer: MFA and registrar lock on the domain account
Hijacking happens at the registrar, so protect that account.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 3 more topics in “Logs, SIEM and incident response” before its exam: SIEM and alert triage, The incident response lifecycle (NIST SP 800-61), A SOC analyst's day and playbooks.
- Module 5 exam: Logs, SIEM and incident response · 13 questions · 25 min, without help. 4 topics of this module still to finish first.
- Then the next module, Malware and web security. 43 topics left in the course before the final exam.