Log analysis essentials
Why it matters: Security Operations is the biggest exam domain, and many of its questions show a log excerpt and ask what happened.
Overview
Supplementary — not from your PDFLogs record who did what, when and from where. Analysts know the key event types, filter out noise, and correlate across sources by time, user and address.
Windows Security event IDs worth knowing
| Event ID | Meaning |
|---|---|
| 4624 | Successful logon (check the logon type: 2 interactive, 3 network, 10 remote interactive) |
| 4625 | Failed logon |
| 4634 / 4647 | Logoff |
| 4648 | Logon using explicit credentials |
| 4672 | Special (admin-level) privileges assigned to a new logon |
| 4688 | New process created (when auditing is enabled) |
| 4720 | User account created |
| 4728 / 4732 | Member added to a security group |
| 4740 | Account locked out |
| 1102 | Security log was cleared, which is suspicious |
| 7045 | New service installed (System log) |
Linux and web logs
- Authentication:
/var/log/auth.log(Debian/Ubuntu) or/var/log/secure(RHEL), orjournalctl. - Web access logs record client IP, time, method, path, status code, size and user agent. Bursts of 401/403/404s from one address deserve a look.
- Always check time zones and clock sync (NTP) before correlating events across systems.
Analyst habits
- Start with a question (what happened to this account or host?), then filter by time window, user, host and event ID.
- Build a timeline, and note the first and last suspicious events.
- Separate true positives from false positives, and tune noisy alerts rather than ignoring them.