MD4 Overview of logs: The importance of logs

Question 1

Logs

Answer 1

A log is a record of events that occur within an organization’s systems.

Logs contain multiple entries which detail information about a specific event or occurrence.

Question 2

Log details

Answer 2

Include details like date, time, location, the action made, and the names of the users or systems who performed the action.

Question 3

Log analysis

Answer 3

Log analysis is the process of examining logs to identify events of interest.

It’s helpful to be selective in what we log, so that we can log efficiently.

Question 4

SIEM tools

Answer 4

SIEM tools provide security professionals with a high-level overview of what happens in a network. SIEM tools do this by first collecting data from multiple data sources. Then, the data gets aggregated or centralized in one place. Finally, the diverse log formats get normalized or converted into a single preferred format.

Question 5

how do logs get collected?

Answer 5

Software known as log forwarders collect logs from various sources and automatically forward them to a centralized log repository for storage.

Question 6

log types

Answer 6

Network

System

Application

Security logs

Authentication logs