PDF p.317
In progress
Log Data
Summary
PDF p.317Log data is essential for investigating security incidents. It includes event message data and metadata from various sources, and accurate logging requires synchronized date and time values. SIEM tools aggregate and correlate logs for better visibility and monitoring.
In plain words
Supplementary — not from your PDFEach log event has message data (what happened) and metadata (source, time, host, process, category and priority). Accurate timelines need synchronized clocks, ideally in UTC. Windows Event Viewer records source, level, user, time and more. Syslog is an open standard for network devices and Linux, with a PRI code (facility and severity), a header and a message. A SIEM collects logs through agents or syslog forwarding.
Detailed explanation
PDF p.317Event Data
- Generated By: Processes on network appliances and general computing hosts.
-
Components
- Event Message Data: Specific notifications or alerts (e.g., "Login failure," "Firewall rule dropped traffic").
- Event Metadata: Source and time of the event, including host/network address, process name, and categorization/priority fields.
Accurate Logging
- Synchronization: Hosts must be synchronized to the same date and time value and format.
- Time Zone: Ideally, use the same time zone or a neutral zone like UTC.
Log Formats
Windows Event Viewer
- Format: Each event has a header with source, level, user, timestamp, category, keywords, and host name.
Syslog
- Usage: Open format, protocol, and server software for logging event messages.
- Sources: Generated by switches, routers, firewalls, UNIX/Linux servers, and workstations.
-
Components
- PRI Code: Calculated from facility and severity level.
- Header: Contains timestamp, host name, app name, process ID, and message ID fields.
- Message Part: Contains a tag showing the source process plus content, formatted as space- or comma-delimited fields or name/value pairs.
Log Data Management
- Individual Analysis: Logs can be kept and analyzed on each host.
- SIEM Tools: Aggregate and correlate logs from multiple sources for a "single pane of glass" view.
- Collection Methods: Via an agent on each host or using syslog to forward event data.
Important terms
taken from the text above- Generated By
- Processes on network appliances and general computing hosts.
- Event Message Data
- Specific notifications or alerts (e.g., "Login failure," "Firewall rule dropped traffic").
- Event Metadata
- Source and time of the event, including host/network address, process name, and categorization/priority fields.
- Synchronization
- Hosts must be synchronized to the same date and time value and format.
- Time Zone
- Ideally, use the same time zone or a neutral zone like UTC.
- Sources
- Generated by switches, routers, firewalls, UNIX/Linux servers, and workstations.
- PRI Code
- Calculated from facility and severity level.
- Header
- Contains timestamp, host name, app name, process ID, and message ID fields.
- Message Part
- Contains a tag showing the source process plus content, formatted as space- or comma-delimited fields or name/value pairs.
- Individual Analysis
- Logs can be kept and analyzed on each host.
- SIEM Tools
- Aggregate and correlate logs from multiple sources for a "single pane of glass" view.
- Collection Methods
- Via an agent on each host or using syslog to forward event data.
Examples & real-world scenarios
Supplementary — not from your PDF- A 'login failure' event with user, host and timestamp.
- Routers forwarding syslog to the SIEM.
- All servers syncing time with NTP in UTC.
Scenario
Investigators can't line up events because servers are in different time zones and some clocks drift by minutes. Synchronizing all hosts to UTC fixes future timelines.
Common mistakes
Supplementary — not from your PDF- Ignoring clock synchronization.
- Keeping logs only on each host, where an attacker can delete them.
Practical skills
Supplementary — not from your PDF- Identify the parts of a syslog message.
- Review the logs on your own system.
What I should remember
Key Points PDF p.317-
Event Data
- Generated By: Network appliances, computing hosts.
- Components: Message data and metadata.
-
Accurate Logging
- Synchronization: Date and time values.
- Time Zone: Use the same or neutral zone.
-
Log Formats
- Windows Event Viewer: Detailed headers.
- Syslog: Open format, various sources.
-
Log Data Management
- Individual Analysis: Host-specific logs.
- SIEM Tools: Aggregate and correlate logs.
- Collection Methods: Agents or syslog.