We are in the complex world where attacks are increasing day by day, so today the cyber intelligence depends on SIEM as a part of infosec (security incident and event management).
Most companies depend on logs and packets to have a better view.. above 90 % of them are working with logs rather than packets. People, process, and technology will be a triangle for security operations.
If you want to take in-depth SOC Training, you can take this SOC Analyst – Cyber Attack Intrusion Training From Scratch to Advanced Level
From this article, you will be knowing that what are logs and how they are parsed through SIEM for better visibility for an analyst to handle an incident.
Logs are an essential part of each device. logs are meaningful elements which can show relevant information about end-user activities to security analyst under SOC(Security Operation Center) and it is also part of the review for audit and compliance.
Let’s take the scenario that the Windows operating system may be your event source and Analyst at another end. What are the activities you are performing from power on to power off will be logged and logs will be sent to Security Operation Center . Users unusual activities will be recorded as an incident in Security operation center.
Logs are three types which will be triggered according to your activities performed in your system
In specific with windows logs are three type system, security, and application
Each application will have their logs, which will be triggered when it contains errors or warning will be sent to SOC for review.
Suspicious User activities for account success and failure logins will be logged and process creation, termination for each and every file accessed by user account logged will be logged into this category.
Logs which footprinting the process of kernel boot, driver updates or failure, windows update and more interesting things will be logged into system log category.
Since security is our concern, we will discuss security logs, look below the figure for better understanding, In this screenshot analyst is analyzing a log for windows event sources.
As I told earlier Siem is built for visibility so, whatever security issues happening with end users should be triggered to Security operation center.
In the above picture, an analyst has clear visibility of end user activities.In this, we can see the event id is 4720.
When a new user account is created for domain accounts or local SAM accounts.Event logs will be established with event id 4720 with respect to new user account creation.
There are similar evil Id’s for hackers 😀
When user account was disabled in local or domain accounts this event id will be triggered in event sources and it will be pushed to siem server for visibility.
A user account was disabled
Suspicious guessing for username and password will be triggered with this event id as an unknown or bad password to the analyst.
An account failed to log on.
When user account was deleted in local or domain accounts this event will be recorded and forwarded to the analyst.
A user account was deleted.
Windows startup or power on will be logged in with respect to the username and will be triggered by the analyst.Cybersecurity analyst will know when you have logged in and logged out timing.
Any successful logins within your network or outside the network will be logged, if it’s your network admin no issues if not it might be a compromise.Should respond as soon as possible.
An account was successfully logged on.
Failed login attempts to the same account will be locked and logged as the event will be investigated for policy violation.
An account failed to log on.
When security, system or application logs are cleared or deleted it will be logged for investigation further forensics methods can be used to retrieve logs.
In general SIEM tool collects logs from devices present in the Organization’s infrastructure. Some solutions also collect NetFlow and even raw packets.
With the collected data(mainly logs, packets), the tool provides an insight into the happenings of the network.
You can follow us on Linkedin , Twitter , Facebook for daily Cybersecurity updates.
j crew cc valid fullz and credit cards
