TechKnowSurge
TechKnowSurge Catalog Videos Logs
VideoSecurityFree

Logs

Log analysis is a core technique for identifying indicators of compromise, with security teams reviewing network, firewall, application, and system logs to detect abnormal activity such as repeated failed login attempts.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Log analysis is one of the most fundamental techniques used to detect indicators of compromise in an IT environment. Servers, workstations, and applications continuously generate log entries in response to system events, giving security teams a detailed record of activity that can be reviewed to identify threats. The process depends heavily on recognizing what normal behavior looks like so that anomalies stand out clearly against expected baselines. A single failed login attempt carries little weight on its own, but a rapid sequence of attempts using different username and password combinations every second is a recognizable pattern consistent with a brute-force credential attack. The ability to distinguish routine noise from meaningful signals is central to effective log review. Security teams draw from a wide range of log sources during an investigation, including network logs, vulnerability logs, operating system logs, access logs, syslog, SNMP, firewall logs, NetFlow data, and application logs. Each source captures a different layer of system activity, and correlating data across multiple sources provides a more complete picture of what occurred and when. Tools such as the Windows Security Event Log offer direct visibility into authentication events and other security-relevant activity, making them a practical starting point for identifying suspicious behavior on Windows-based infrastructure.

What you'll learn

What's covered

Logs as Indicators of Compromise

Key terms

Log Management
The process of collecting, storing, analyzing, and monitoring log data generated by systems and applications.
Indicators of Compromise
IoC
Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Intrusion Detection System
IDS
A system that monitors network or system activities for malicious behavior and generates alerts.
Simple Network Management Protocol
SNMP
A protocol used to monitor and manage network devices such as routers, switches, and servers.
Firewall
A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Brute Force Attack
An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Baseline
A documented set of minimum security standards or performance metrics used as a reference point.

Topics

Log Analysis Indicators Of Compromise Security Monitoring Firewall Logs Network Logs Cybersecurity Threat Detection

Transcript

Why We Look at Logs

One thing we'll be scanning for indicators of compromise will be the logs. Logging is something that happens when there's some sort of event on a device or an application, and there are lots of ways that we do logging. Essentially, a server that has a database, and machines like these, have logs attached to them, so that whenever something triggers an event, that event gets logged. We can then pour over these logs to see what's happening on our systems.

An Example of a Suspicious Log

Here's just one example of a log that we might see that could be an indicator of a compromise. There's some sort of login event, and some user and password was rejected. Now, just one of these might not be a big deal. People get usernames and passwords wrong all the time, so it does happen out there. But if we see that every second we've got a different username and password combination being tried, this is an indicator that there's an attack on the system.

The Logs We Look At

Here are some of the logs that we would look at:

  • Network
  • Vulnerability
  • Operating system
  • Access
  • Syslog
  • SNMP
  • Firewall
  • NetFlow
  • Application logs

One of the things that we're looking for is anything that's out of cycle. We're looking for logs that show that something's a bit off. Everything here looks fairly normal, but if we were to see something that's outside of the boundaries of what's normal, that's what we're looking for.

I jumped on a Windows Server machine and pulled up the log files. In fact, I pulled up the security log file, so we can see the security log files in there. This could be one source, one thing that we're looking at to see if there's some sort of indicator of compromise.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →