Security Log Analysis Fundamentals

Why logs matter

Logs are the memory of your systems. Without them you cannot tell what happened after an incident. "Security Logging and Alerting Failures" is one of the OWASP Top 10 categories for a reason (see OWASP Top 10 explained).

Where to find them

Read a failed-login pattern

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head

This counts failed SSH logins per source IP. Then check whether the same IP later has an Accepted password line — the classic brute-force-then-success pattern. Practise on our synthetic Brute-Force Timeline challenge.

What to look for

• Many failures from one source, then a success.
• Logins at odd hours or from unusual countries.
• New accounts, privilege changes and sudo commands you did not expect.
• A Windows program such as Word spawning PowerShell (event 4688) — see Triage the Alert.

Good logging habits

1. Synchronise clocks (NTP) so timelines line up.
2. Centralise logs in a SIEM such as Wazuh so attackers cannot simply delete local copies.
3. Protect logs from tampering and keep them long enough for investigations.
4. Write detections as rules, for example in the Sigma format.
5. Never log secrets such as passwords or reset tokens.

Next step

Learn how logs fit into investigations in digital forensics.