CompTIA Security+ Preparation · lesson 34 of 45 · 25 min
Log Management Fundamentals
Logs are the foundation of security monitoring, incident response, and forensic investigation. Every security event leaves a trace in logs.
Log sources: OS logs (Windows Event Log, Linux syslog/journald), application logs, firewall logs, IDS/IPS logs, authentication logs (Active Directory, RADIUS), DNS logs, web server logs, cloud audit logs (AWS CloudTrail, Azure Activity Log).
Windows Event IDs to know: 4624 (successful logon), 4625 (failed logon), 4648 (logon with explicit credentials), 4720 (user account created), 4732 (user added to privileged group), 4776 (credential validation), 1102 (audit log cleared), 7045 (new service installed).
Syslog — standard protocol for sending log messages over a network. UDP port 514 (traditional), TCP 514 or 6514 (TLS). Severity levels 0–7: Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug.
Log retention — how long logs are kept. Compliance requirements: PCI-DSS requires 1 year, HIPAA requires 6 years. Logs must be protected from tampering (write-once storage, digital signatures).
SIEM Architecture and Threat Hunting
SIEM components: Log collection (agents, syslog, API), normalization (parse different log formats into a common schema), correlation (match events across sources), alerting (notify analysts), dashboards (visualize security posture), forensic search.
Correlation rules — logic that matches patterns across multiple events. Example: “Alert if the same IP has 5+ failed logins in 60 seconds followed by a successful login.”
Threat hunting — proactive search for threats that have evaded automated detection. Hypothesis-driven: “I believe an attacker is using PowerShell for lateral movement — let me search for unusual PowerShell executions.” Uses SIEM, EDR, and threat intelligence.
UEBA (User and Entity Behavior Analytics) — uses machine learning to establish baselines and detect anomalies. Example: user logging in from a new country at 3 AM, accessing 10x more files than usual.
Popular SIEMs: Splunk (market leader), Microsoft Sentinel (cloud-native), IBM QRadar, Elastic SIEM (open source), LogRhythm.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Log Analysis & SIEM
Windows Event ID 4625 indicates:
- Successful logon
- Failed logon
- Account created
- Log cleared
- Answer: Failed logon
Event ID 4625 = failed logon. Multiple 4625 events followed by a 4624 (success) indicates a brute force attack. Windows Event ID 1102 is a major IoC because:
- It indicates a successful login
- It indicates the security audit log was cleared — attackers clear logs to hide activity
- It indicates a new user was created
- It indicates a service failed
Answer: It indicates the security audit log was cleared — attackers clear logs to hide activity Log clearing (Event ID 1102) is a strong indicator of compromise — legitimate admins rarely clear security logs. SIEM correlation rules are used to:
- Encrypt log data
- Match patterns across multiple events to detect threats
- Store logs long-term
- Generate compliance reports only
- Answer: Match patterns across multiple events to detect threats
Correlation rules connect dots across different log sources — a single failed login is noise; 100 failed logins from one IP is an alert. Threat hunting differs from SIEM alerting because:
- Threat hunting is automated
- Threat hunting is proactive and hypothesis-driven; SIEM alerting is reactive
- SIEM alerting is more thorough
- They are identical
- Answer: Threat hunting is proactive and hypothesis-driven; SIEM alerting is reactive
SIEM alerts on known patterns. Threat hunting proactively searches for unknown threats using analyst intuition and threat intelligence. UEBA detects threats by:
- Matching known malware signatures
- Establishing behavioral baselines and detecting anomalies using ML
- Scanning for open ports
- Checking patch levels
- Answer: Establishing behavioral baselines and detecting anomalies using ML
UEBA learns normal behavior patterns and alerts when users or systems deviate significantly — catches insider threats and compromised accounts.
Syslog uses which port by default?
- 443
- 514
- 8080
- 161
Answer: 514
Syslog traditionally uses UDP port 514. Secure syslog over TLS uses TCP port 6514.
PCI-DSS requires log retention for:
- 30 days
- 6 months
- 1 year
- 7 years
- Answer: 1 year
PCI-DSS requires 12 months of log retention, with 3 months immediately available for analysis. Log normalization in a SIEM means:
- Deleting duplicate logs
- Parsing different log formats into a common schema for correlation
- Encrypting log data
- Compressing logs for storage
- Answer: Parsing different log formats into a common schema for correlation
Different systems log in different formats — normalization converts them all to a common structure so they can be correlated. AWS CloudTrail is an example of:
- A SIEM platform
- A cloud audit log — records all API calls in an AWS account
- A vulnerability scanner
- A firewall service
- Answer: A cloud audit log — records all API calls in an AWS account
CloudTrail logs every API call in AWS — who did what, when, from where. Essential for cloud security monitoring and forensics.
The syslog severity level for the most critical messages is _____ (level 0).
Answer: Emergency
Syslog severity 0 = Emergency (system is unusable). The scale goes: 0-Emergency, 1-Alert, 2-Critical, 3-Error, 4-Warning, 5-Notice, 6-Info, 7-Debug.
Previous lesson: Digital forensics: chain of custody, acquisition, analysis
Back to CompTIA Security+ Preparation
Next lesson: Threat intelligence: STIX/TAXII, threat feeds, MITRE ATT&CK framework