Log Data
- •
def
- •
detailed records of security-relevant activity, used for both real-time monitoring and after-the-fact investigation
- •
- •
types
- •
firewall logs — traffic flows (source/destination IP, port, disposition); NGFWs also log the application used, URL filtering categories, and anomalies
- •
application logs — vary by application; e.g., Windows Event Viewer, or
/var/logon Linux/macOS - •
endpoint logs — logon events, policy changes, system events, processes, account management, directory services, etc.
- •
OS-specific security logs — authentication details, brute force attempts, disabled services
- •
IPS/IDS logs — timestamp, attack type/class, source and destination IP/port
- •
network logs — switches, routers, access points, VPN concentrators; routing updates, authentication issues, network security issues
- •
metadata — data describing other data, e.g. email headers, mobile GPS location, web browser/OS/IP, or file name/author/title
- •
- •