Log data is a record of activity, typically saved in binary format, along with metadata such as timestamps and other information about the event being logged. From your firewall to your database server, if a system is designed correctly, it will generate logs in almost every part. Log management is a crucial part of IT infrastructure, and log information is key to identifying cybersecurity threats.
With rising security concerns, more and more organizations are turning to log data analysis to improve their understanding of their system's behavior. Organizations that are searching for ways to integrate security controls with logs to detect and respond to threats quickly can implement log monitoring, which lets you explore your logs and create alerts and reports across your entire system.
Source: 2021 Benchmark Report │ Log Management and Analytics
Types Of Log Data
Logs are a vital part of security monitoring. They provide a semi-automated way to track events across an entire network in real time. Monitoring logs can help you detect security threats and prevent them from impacting your business. The following chart provides the types of logs that organizations are using to understand system behavior and help identify cyberattacks.
Source: 2021 Benchmark Report │ Log Management and Analytics
By reviewing log files regularly, you can identify and stop malicious activity before it becomes a problem. Logs can be analyzed in many ways, including by type of device, location and time of day.
Several tools exist for cybersecurity professionals to view and aggregate logs across an organization. The most common software found at larger organizations is called security information and event management (SIEM) software, such as Splunk, Middleware, LogRhythm, Qradar and the Elastic ELK stack. Other less expensive solutions used by medium and smaller businesses include endpoint detection and response (EDR) solutions, such as Singularity, Falcon, Trend Micro XDR and Harmony Endpoint.
Many different types of logs can provide valuable insights into cyberattacks and other security issues. Here are some examples:
1. Perimeter Device Logs
Firewalls, intrusion detection systems (IDS) and web proxies record information about all traffic that passes through them so that administrators can see if anyone tries to access the network without permission or tries to gain unauthorized access to sensitive resources.
For example, suppose a malicious employee is stealing company secrets and sending them out over email. In that case, you should be collecting email server logs at the perimeter of your network. These include network devices like firewalls, routers and switches, and software or hardware appliances that provide network security.
This log generates helpful information about traffic to/from an organization's network. It also helps identify suspicious activity and users trying to access unauthorized data or resources within an organization's network.
2. Windows Event Logs
Windows event logs are used for auditing and system monitoring. They can monitor the security of your critical applications, servers and other devices. The Windows event log contains a wealth of information that can be used to troubleshoot problems and identify potential security threats. They also record internal errors generated by applications or operating systems themselves.
The following types of information are logged in the Windows event log:
- Application error messages
- Security audit events
- Operating system events
- Logon/logoff events
Windows event logs are a critical source of information for intrusion detection and forensic analysis. They can be used to audit what has happened on the system and are often used to reconstruct the events leading up to a breach. So, you must monitor them closely.
3. Endpoint Logs
Endpoint log data is generated by endpoints such as workstations, laptops, smartphones or tablets. Endpoint logs can include files accessed, applications used and other activities on the device. These logs can help detect malware infections and other suspicious activity on endpoints.
For example, an endpoint log would show that a user opened Microsoft Word and saved their work, or it could indicate that a virus was detected by antivirus software installed on the device. This information can help identify potentially rogue devices on your network or determine how many people use their devices to access company resources.
Endpoint logs also include information about each device's operating system and software applications running on the device — information that can help detect unauthorized software installations or other attempts at malicious activity.
4. Application Logs
Application logs record information about the actions of users within an application or service, such as when they access or modify data in programs like Microsoft Office, Google Chrome web browser and Adobe Reader PDF reader. They can also record users' actions on a website or mobile app.
Application logs provide valuable insight into user behavior and help organizations determine whether changes to their applications have improved or worsened the experience for users who access them.
They're also known as event logs because they record application-related events instead of just raw data like a system log. For example, if you use Chrome, application logs will record when you open websites or other web pages in Chrome and keep track of any crashes or errors that occur while using Chrome (or any other browser).
5. Proxy Logs
Proxy logs are similar to firewall logs in that they show network traffic but differ in terms of what they record and how they do so. Proxy logs record every request made to a particular server, regardless of whether there was an error. For example, if someone tries to access a website through a proxy server but fails because the website isn't available, this will still be recorded in the logs.
The proxy server's logs record all requests, responses and information about each request's source and destination IP addresses. Proxy server (NGINX / HAProxy) log files contain analysis of HTTP requests coming through proxy servers. They can be used to identify malicious requests such as DDoS attacks or brute force attempts against your web application(s).
6. IoT Logs
IoT logs contain information about connected devices such as smart home appliances or other devices that are part of the Internet of Things (IoT).
In a world where everything is connected and communicating with each other, IoT logs from these devices can be very valuable, but are often overlooked as sources of security data. If one device has been compromised, it may have infected others in the same network and organization. Using IoT logs can help find and isolate compromised systems before they become a problem.
For example, if a smart thermostat is hacked, it can be detected by analyzing the log data generated by that device. Log data from IoT devices can also determine if employees have used their work devices for personal use (such as social media).
7. Storage Area Network (SAN) Infrastructure Logs
SANs are used to store data that is essential for business operations. Multiple servers and applications can access the storage resources in a SAN; hence, this infrastructure's security is critical. To ensure security, SAN administrators should keep track of all changes to the SAN environment.
For example, if an administrator makes changes to the SAN configuration, it should be logged so that another administrator can review them later. This will help identify unauthorized activities, such as someone accessing the wrong server or deleting files from a particular volume.
The following events should be logged:
- Connections from other devices or systems
- Changes made to SAN configuration (such as adding new volumes or replacing existing disks)
- Accessing and modifying data on volumes
Log Data is Key to Identifying Cyber Threats
Log data is invaluable to cybersecurity. It provides insight into how your network is being utilized, your users' behavior, the success of past policies and procedures, and potential breaches. Log data, when used correctly, can provide valuable information that helps organizations monitor and protect their networks. Log data analysis is a growing field that will require experience and deep knowledge of the concepts to interpret them correctly.
If you are interested in proving your skills and mastering logs and cybersecurity, consider studying for CompTIA Security+ and CompTIA Cybersecurity Analyst (CySA+). CompTIA Security+ covers logs from a security administration perspective, while CompTIA CySA+ covers logs from an in-depth security analyst perspective.
Ready to get started? Request a free trial of CertMaster Learn + Labs.
Savan Kharod is a growth marketer at Middleware. He is an engineer turned marketer and a tech enthusiast. He likes to read novels when not solving dev marketing issues. Say hello to him on LinkedIn.
