Where defenders live: the logs

Earlier in your learning you may have read a login log by hand. At scale, organisations collect logs from everything into a SIEM (Security Information and Event Management) system, which lets analysts search, correlate, and alert on suspicious activity. The popular open stack is ELK (Elasticsearch, Logstash, Kibana).

Here is the core skill in miniature, counting failed logins, the kind of signal a SIEM watches for:

A SIEM does exactly this, but across millions of events, from many machines, in real time, and raises an alert when a pattern looks like an attack.

Resources

• ELK Stack tutorial (Logz.io)
• Elastic Stack features

Practice

Name three systems in an organisation whose logs a security team would want to collect (for example, the firewall). For each, write why it matters.